JWT

Apprentice lab:
JWT authentication bypass via unverified signature

This lab uses a JWT-based mechanism for handling sessions. Due to implementation flaws, the server doesn't verify the signature of any JWTs that it receives.
To solve the lab, modify your session token to gain access to the admin panel at /admin, then delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter

• Solution

  1. Log in as wiener:peter.
  2. Notice cookie is a JWT. Run jwt_tool.

     ./jwt_tool.py <token> -T

  3. Tamper with it, replacing wiener -> administrator.
  4. Open browser's developer tools under the Storage tab in cookies, replace the value with the one generated from the tool.
  5. Delete Carlito.

Caution

JWT uses Base64url, which is slightly different from Base64.

Base64	Base64url
+	-
/	_
=