JSON Web Token Hacking

Do you prefer Tom or Jerry?

Correct me if i'm wrong! but the main reason for using the JWT is to verify the user without the need to connect a database and compare the values? and also changing the values of the payload misses completely the signature , which already encrypted with secret key and should be rejected in the first place, if someone uses the JWT without verifying it somehow in their website he shouldn't use JWT at all, it's like giving access to everyone and trusting blindly every user!! Steps as far as i know : 1 - get the JWT 2 - verify the signature by decrypting it using the secret key (the most important), exp ... 3 - proceed to the next step (perform any action you need) if 1 fails, reject everything if 1 doesn't fail and 2 fails reject everything if 1 and 2 doesn't fail now you can go to the step three and perform the action

Brother, I love all your videos. They are concise, quick, no bullshit, no music and you could not have done a better job.

Interesting technique, another scenario to add to my vuln checking, thanks for sharing

While this is good one, it very much depends on dal layer which is by default prevented by dal fw. Also someone using jwt must be using some sort of lib, and not.directly doing jwt implementation. So might not be taht much practical in real world.... Not sure if there is some one that idiot in real world.who queries SQL directly.

Good brief, Loi. Thanks. I touch on this subject for the PenTest+ class I teach. Useful content here.

how did key-id with sql query from some table that gives you no useful information, give you the authorization to delete user? server side key id targets nothing and server does not throw an error so then it authenticates you?

Is it possible to hack if MongoDB is being used?

Sir Loi, it was a great hacking tutorial! But now the thing is, how can "we" secure our JWT tokens and the websites using JWT?

is it mean you have to know the server containing the key first?

Hello, Thanks for the video. How can we prevent this ?

Hey how did you learn to hack , like any courses or like college ?

That's why I add en encryption layer. To make it "harder"

I've also done this once in a CTF by setting the algorithm to none :D

I'm a bit confused. I thought the whole purpose of the JWT being secure is that the token CAN'T be manipulated (without knowing the private key). When the KID property, EXP property, etc. was changed, I would assume the the server will immediately reject it because the signature would no longer match. Or is the JWT token being used differently in this example?

every website encrypt token different with different algorithms. I tried that website and it didnt tell me token information.

U always have good vids! 👏 Keep going!

1:18 - "We're trying to remove the cats account"... That sounds so wrong lmao

I didn't understand how you knew the key?

How would you protect against this attack?