Naked: weak secret

One bug: the HS256 signature is real — tampering with the payload alone is rejected — but the signing key is weak. Crack it (hashcat -m 16500 / jwt_tool against rockyou), re-sign a role:admin token, and reach /naked/weak-secret/admin. alg:none will NOT help you here.

your session token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciJ9.9Jhx6ri14g1cwfMTV_GYT9WlA2bROZJSKLMaieeKueE

header

{
  "alg": "HS256",
  "typ": "JWT"
}

payload

{
  "sub": "demo",
  "uid": 2,
  "role": "user"
}

Present your forged token as the pp_weak cookie, or as ?token=<jwt>.

More hands-on practice → labs.hackxpert.com