API 02: Exploitation - JWT Vulnerability

Description: In this video, we explore the challenge API_02 from the API badge on PentesterLab. We demonstrate how to exploit a JWT token vulnerability to gain unauthorized access to another user's secret.

1. Context & Situation#

Target: API 02 (Secrets Endpoint) Initial Problem: I tried to do the same trick as before (IDOR). I took my valid Token, decoded it, changed the ID from 2 to 1, and encoded it back. When I sent the request:

• Result: 401 Unauthorized.
• Why? The server checked the Signature. Because I changed the data (Payload) but couldn't generate a valid signature (I don't have the server's secret key), the server rejected it.

2. The Vulnerability#

Type: JWT Signature Bypass (specifically "None Algorithm" Attack). Impact: I can forge my own tokens and become any user (like admin or user ID 1) without knowing the secret password.

3. The Goal#

To trick the server into accepting a token that has no signature. We want to tell the server: "Hey, this token is not signed, please don't check the signature."

4. The Tool#

Website: jwtauditor.com (opens in a new tab) This tool makes it easy to:

1. Paste your token.
2. Edit the Payload (change ID).
3. Critical Step: Change the Algorithm in the header to None.
4. Remove the signature automatically.

5. The Attack Steps (How to reproduce)#

Step 1: Get a Valid Token#

First, I logged in (or used the default credentials) to get my legit token for user ID 2.

• Token Payload: {"id": 2, ...}

Step 2: The Failed Attempt (Tampering)#

I manually changed the ID to 1 using base64 commands in the terminal.

• Command: curl ... -H "Authorization: Token <My_Fake_Token>"
• Result: 401 Unauthorized.
• Lesson: You cannot just change the text; the signature must match.

Step 3: The Exploit (Using JWT Auditor)#

1. Go to jwtauditor.com (opens in a new tab).
2. Paste the valid token.
3. In the Header, change "alg": "HS256" to "alg": "none".
4. In the Payload, change "id": 2 to "id": 1.
5. The tool generates a new token that looks like xxxxx.yyyyy. (notice the empty part at the end).

Step 4: Sending the Attack#

Copy the new "None" token and send it via curl.

• Command:

  bashCopy

  curl 'https://.../api/secrets/1' \
  -H 'Authorization: Token eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpZCI6MSwiZXhwIjoxNzczMDkyMTg5fQ.'