WEB 004 - JWT attacks

Your token decodes to: {"user": "guest", "role": "user"}

You are issued a role:user HS256 token (cookie cwap_jwt). The signing secret is weak and the verifier also accepts alg:none. Forge a role:admin token and set the cookie.

current cookie: cwap_jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QiLCJyb2xlIjoidXNlciJ9.bx33B7Bp884CqBQ99VLJg1LGEs03istwE4yucGpqYFI

crack the HS256 secret (it is a common word) or strip the signature with alg=none.


CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only