Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-10 06:34:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

Create Lab2.md

Browse source
This commit is contained in:
ARZ 2022-07-07 15:39:37 +05:00 committed by GitHub
parent 19fa053784
commit abe541970c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 46 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
Portswigger/JWT/Lab2.md Normal file
View file

@ -0,0 +1,46 @@
# Portswigger JWT - Lab 2
## JWT authentication bypass via flawed signature verification
In this lab we need bypass authuntication via flawed JWT signature verfication to become the administrator user by modifiying token and access `/admin` , we can login with the credentials `wiener:peter` as a normal user
<img src="https://i.imgur.com/1PjGPnb.png"/>
<img src="https://i.imgur.com/quEHQKc.png"/>
<img src="https://i.imgur.com/ADQx4qt.png"/>
We can try accessing `/admin` , which only allows the `administrator` user to access it
<img src="https://i.imgur.com/B5Bwb7Z.png"/>
Checking the session cookie from developer tools
<img src="https://i.imgur.com/IMCZlid.png"/>
We can see a JWT token which can be analyzed by going to https://token.dev/
<img src="https://i.imgur.com/gHboZdR.png"/>
I tried modifying the name username to `administrator`
<img src="https://i.imgur.com/WlfQ2Kc.png"/>
But when changing the JWT it just logs out the user
<img src="https://i.imgur.com/GxIv8LQ.png"/>
It could be that it doesn't valid what algorithm is being used so we can try to set `alg` to `none`
<img src="https://i.imgur.com/fU9qIP8.png"/>
But also to add `.` at the end of payload part
<img src="https://i.imgur.com/8i7IJu5.png"/>
<img src="https://i.imgur.com/ELdTvtZ.png"/>
After deleting carlos user we can solve the lab
<img src="https://i.imgur.com/4Dbgs5v.png"/>