JWT authentication bypass via unverified signature

https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature

Description

This lab uses a JWT-based mechanism for handling sessions. Due to implementation flaws, the server doesn't verify the signature of any JWTs that it receives.

To solve the lab, modify your session token to gain access to the admin panel at /admin, then delete the user carlos.

You can log in to your own account using the following credentials: wiener:peter

Solution

Go to login page and access as wiener user.

JWT extension reveal that there's a JWT token, obviously related to wiener user account

{"iss":"portswigger","exp":1742668339,"sub":"wiener"}

Send it to repeater and select JSON web Token tab to deep dive to it

Modify the sub field inserting: "administrator" (if the key field isn't compiled, is necessary to add it clicking to Sign button)

and click first on the Send button and then on Following redirection button

authenticating us as administrator

Checking the response the admin panel's path is: /admin

so we can move there via a GET request: GET /admin HTTP/2

analyzing the response, we see that the request to delete the user Carlos is the following: GET /admin/delete?username=carlos HTTP/2

So, Send and click to Following redirection to delete it and complete the lab.