Naked: alg:none

One bug: this verifier trusts the header alg. A demo role:user session is below. Reach /naked/alg-none/admin as role:admin. Hint: what does the verifier do if a token says it is not signed at all?

your session token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciJ9.baf1-zQ92CGx_rGyGH6e0lIDkngpzfK_-I9pgS5BR2E

header

{
  "alg": "HS256",
  "typ": "JWT"
}

payload

{
  "sub": "demo",
  "uid": 2,
  "role": "user"
}

Present your forged token as the pp_algnone cookie, or simply append ?token=<jwt> to the admin URL.

More hands-on practice → labs.hackxpert.com