Apprentice
Please login first!
← back to room
JWT

JWT Attacks

Scenario

Production tokens use HS256 with a short shared secret chosen during a hackathon. The same secret signs every user's cookie. Forge a valid signed admin token without logging in as admin.

Your approach

  1. Inspect an existing JWT and note header alg HS256.
  2. Guess or brute-force the weak signing secret from common wordlists.
  3. Build a new payload with admin claims and sign with the recovered secret.
  4. Replace your cookie and trigger the admin verification endpoint.
  5. Submit the weak-secret forge flag.
The app trusts JWTs. Try alg:none, crack/forge with a weak HMAC secret, or tamper the role claim. Submit the token below to verify.

Your token

HS256 secret is a common English word (very short). Target payload: {"user":"hacker","role":"admin"}