Apprentice
← back to room
JWT

JWT Attacks

Scenario

TokenGate stores a signed cookie gating access to admin routes. Legacy code accepts tokens whose header algorithm is set to none. Forge a cookie claiming admin role without a valid signature.

Your approach

  1. Capture your session JWT from browser storage or cookies.
  2. Decode header and payload; set alg to none and role to admin.
  3. Remove or empty the signature segment and re-submit the token.
  4. Access the protected admin action and read the bypass flag.
  5. Submit the alg-none flag.
The app trusts JWTs. Try alg:none, crack/forge with a weak HMAC secret, or tamper the role claim. Submit the token below to verify.

Your token

HS256 secret is a common English word (very short). Target payload: {"user":"hacker","role":"admin"}