BOOK THIS SPACE FOR AD
ARTICLE ADThis lab uses a JWT-based mechanism for handling sessions. In order to verify the signature, the server uses the kid parameter in JWT header to fetch the relevant key from its filesystem. To solve the lab, forge a JWT that gives you access to the admin panel at /a dmin, then delete the user carlos. You can log in to your own account using the following credentials: wiener:peter | Karthikeyan Nagaraj
This lab uses a JWT-based mechanism for handling sessions. In order to verify the signature, the server uses the kid parameter in JWT header to fetch the relevant key from its filesystem.
To solve the lab, forge a JWT that gives you access to the admin panel at /admin, then delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter
Tip
We recommend familiarizing yourself with how to work with JWTs in Burp Suite before attempting this lab.
Generate a suitable signing key
In Burp, load the JWT Editor extension from the BApp store.In the lab, log in to your own account and send the post-login GET /my-account request to Burp Repeater.Go to the JWT Editor Keys tab in Burp’s main tab bar.Click New Symmetric Key.In the dialog, click Generate to generate a new key in JWK format.Replace the value for the k with a Base64-encoded null byte (AA==). Click OK to save the key.Modify and sign the JWT
Go back to the GET /admin request in Burp Repeater and switch to the extension-generated JSON Web Token message editor tab.In the header of the JWT, change the value of the kid parameter to a path traversal sequence pointing to the /dev/null file:../../../../../../../dev/nullIn the JWT payload, change the value of the sub claim to administrator.At the bottom of the tab, click Sign, then select the symmetric key that you generated in the previous section.Make sure that the Don’t modify header option is selected, then click OK.Send the /admin/delete?username=carlosrequest and observe that you have successfully deleted the user carlos.
A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups
Telegram Channel for Free Ethical Hacking Dumps
Thank you for Reading!
Happy Ethical Hacking ~
Author: Karthikeyan Nagaraj ~ Cyberw1ng