{"user": "guest", "role": "user"}You are issued a role:user HS256 token (cookie cwap_jwt). The signing secret is weak and the verifier also accepts alg:none. Forge a role:admin token and set the cookie.
current cookie: cwap_jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QiLCJyb2xlIjoidXNlciJ9.bx33B7Bp884CqBQ99VLJg1LGEs03istwE4yucGpqYFI
crack the HS256 secret (it is a common word) or strip the signature with alg=none.
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only