Apprentice
← all rooms
JWT Hard

JWT Attacks

Forge admin access with alg:none or a weak HMAC secret.

Mission briefing

TokenGate protects an admin dashboard with JSON Web Tokens in cookies. Developers chose fast HS256 signing and left legacy verification paths in place. Obtain admin-level access without knowing a legitimate user's password.

0 / 2 tasks 0 / 25 pts

Objectives

  • Bypass signature with alg:none
  • Forge HS256 with a weak secret
Task 1 alg:none Medium 10 pts

Scenario

TokenGate stores a signed cookie gating access to admin routes. Legacy code accepts tokens whose header algorithm is set to none. Forge a cookie claiming admin role without a valid signature.

Your approach

  1. Capture your session JWT from browser storage or cookies.
  2. Decode header and payload; set alg to none and role to admin.
  3. Remove or empty the signature segment and re-submit the token.
  4. Access the protected admin action and read the bypass flag.
  5. Submit the alg-none flag.

Submit a none-alg admin JWT.

Open lab →
Hint

Header {"alg":"none"} + payload role=admin + empty signature

Task 2 Weak secret Hard 15 pts

Scenario

Production tokens use HS256 with a short shared secret chosen during a hackathon. The same secret signs every user's cookie. Forge a valid signed admin token without logging in as admin.

Your approach

  1. Inspect an existing JWT and note header alg HS256.
  2. Guess or brute-force the weak signing secret from common wordlists.
  3. Build a new payload with admin claims and sign with the recovered secret.
  4. Replace your cookie and trigger the admin verification endpoint.
  5. Submit the weak-secret forge flag.

Crack/forge HS256 with secret=secret.

Open lab →
Hint

HMAC secret is literally: secret