Portswigger walkthrough(JWT)(apprentice)

Lab: JWT authentication bypass via unverified signature

This lab uses a JWT-based mechanism for handling sessions. Due to implementation flaws, the server doesn’t verify the signature of any JWTs that it receives. To solve the lab, modify your session token to gain access to the admin panel at /admin, then delete the user carlos. You can log in to your own account using the following credentials: wiener:peter

Make sure Burp Suite is running and the proxy is enabled before you begin the lab. For working with JWTs, install the JWT Editor extension from the BApp Store, which you can access from the top section of Burp Suite’s dashboard. Click on access the lab

Click on “My Account”Log in to the account using the following username:wiener and password: peter

Open Burp Suite and look for a GET request that includes something like my-account?id=wiener . Once you find it, right-click on the request and choose “Send to Repeater” to begin analyzing or modifying it.

In the session cookie, you’ll notice a structure separated by dots. The part before the first dot is the token header, the section between the first and second dots is the payload, and everything after the second dot is the signature. This signature is created by hashing the header and payload using a secret key. If you modify either the header or the payload, the signature will no longer be valid, and the server will reject the token.

The next step in the lab involves modifying the JWT payload. Specifically, you’ll change the field from wiener to peter

and in JSON web token you will change the administrator then click send later copy this path /delete?username =carlos from response .

The user carlos get deleted and hence Lab solved !!

==============================================================================================================================

Lab: JWT authentication bypass via flawed signature verification

This lab uses a JWT-based mechanism for handling sessions. The server is insecurely configured to accept unsigned JWTs.To solve the lab, modify your session token to gain access to the admin panel at /admin, then delete the user carlos.You can log in to your own account using the following credentials: wiener:peter

Make sure Burp Suite is running and the proxy is enabled before you begin the lab. For working with JWTs, install the JWT Editor extension from the BApp Store, which you can access from the top section of Burp Suite’s dashboard. Click on access the lab

Click on “My Account”Log in to the account using the following username:wiener and password: peter

Try replacing /my-account in the URL with /admin to see if it grants access to the admin panel.

In burpsuite check /admin and right click on it and send it to the repeater

In the session cookie, you’ll notice a structure separated by dots. The part before the first dot is the token header, the section between the first and second dots is the payload, and everything after the second dot is the signature. This signature is created by hashing the header and payload using a secret key. If you modify either the header or the payload, the signature will no longer be valid, and the server will reject the token.

Also JSON webtoken in request side it appears only when there is a valid JWT tokens are present and if you click on we can modify the decoded details

In this lab, although the server typically verifies JWT signatures, it’s vulnerable and accepts tokens without any signature. So, we attempt to modify the username from “weiner” to “administrator,” then launch the attack by choosing the “none” signing algorithm — specifically the lowercase “none” — which tricks the server into accepting an unsigned token.

After selecting complete lower case “none” from the dialog box click on send and search for carlos and copy that line and click on raw to delete it