A pack of isolated JWT / authentication mini-labs. Each one issues and accepts its own token, so exactly one bug is in play at a time. Always decode the token first (jwt.io / jwt_tool): the header alg and the claims are the whole game. Track your findings on /progress. NO FLAGS.
Naked labs — one exploit each, nothing in the way
NAKEDalg:none The verifier honours an unsigned alg:none token.
NAKEDWeak HS256 secret The HS256 signing key is a single dictionary word.
NAKEDkid path traversal The kid header picks a key file off disk, unsanitised.
NAKEDexp not validated Expiry is never enforced on an otherwise-valid token.
NAKEDPredictable reset The reset token is a non-secret function of the email.
Methodology labs — you must hunt for the method
METHODOLOGYWhich attack? A login mints a JWT. Decode it, recon it, and work out which single attack actually works - only ONE does; the rest are correctly rejected.