Hellow guys, Welcome to my website, and you are watching JWT Authentication Bypass via jwk Header Injection. and this vIdeo is uploaded by Intigriti at 2023-07-03T07:40:00-07:00. We are pramote this video only for entertainment and educational perpose only. So, I hop you like our website.
| Name | JWT Authentication Bypass via jwk Header Injection |
| Video Uploader | Video From Intigriti |
| Upload Date | This Video Uploaded At 03-07-2023 14:40:00 |
| Video Discription | π©βππ¨βπ Learn about JSON Web Token (JWT) vulnerabilities. The server supports the jwk (JSON Web Key) parameter in the JWT header. This is sometimes used to embed the correct verification key directly in the token. However, it fails to check whether the provided key came from a trusted source. To solve the lab, we'll modify and sign a JWT that provides access to the admin panel, then delete the user carlos. Overview: 0:00 Intro 0:13 Recap 0:38 JWT header parameter injections 1:30 Injecting self-signed JWTs via the jwk parameter 2:17 Symmetric vs asymmetric algorithms 3:40 JWT Editor extension (burp) 4:26 Lab: JWT authentication bypass via jwk header injection 5:43 Solution #1: python 8:59 Solution #2: burp suite 10:34 Solution #3: jwt_tool 13:18 Conclusion If you're struggling with the concepts covered in this lab, please review the Introduction to JWT Attacks video first: https://youtu.be/GIq3naOLrTg π§ For more information, check out https://portswigger.net/web-security/jwt π Portswigger challenge: https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection π§π» Sign up and start hacking right now - https://go.intigriti.com/register πΎ Join our Discord - https://go.intigriti.com/discord ποΈ This show is hosted by https://twitter.com/_CryptoCat ( @_CryptoCat ) & https://twitter.com/intigriti π Do you want some Intigriti Swag? Check out https://swag.intigriti.com π Python scripts demonstrated in this series can be found here: https://github.com/Crypto-Cat/CTF/tree/main/web/WebSecurityAcademy/jwt |
| Category | Education |
| Tags | jwk | header | json web key | json web token | JWT | JWTs | json | json web tokens | token | tokens | authorization | signature | key | secret | signing | repeater | exploit | intigriti | hackademy | portswigger | web security academy | academy | burp | burp suite | websec | web security | ethical hacking | bug bounty | pentesting | pentest | penetration test | proxy | bug hunting | vuln | vulnerability | cybersecurity | infosec | offsec | learn | tutorial | guide | walkthrough | training | hack | cryptocat | insecure code | websecacademy | appsec | header injection |
