Listen to this Post
Introduction
JSON Web Tokens (JWT) are widely used for authentication and authorization in modern web applications. However, misconfigurations and weak implementations can lead to severe security flaws. In this guide, we’ll explore how to identify and exploit JWT vulnerabilities, inspired by real-world bug bounty success stories.
Learning Objectives
- Understand common JWT vulnerabilities and attack vectors.
- Learn how to manipulate JWT tokens for unauthorized access.
- Apply techniques to test and secure JWT implementations.
1. Understanding JWT Structure
A JWT consists of three parts: Header, Payload, and Signature, separated by dots (e.g., xxxxx.yyyyy.zzzzz).
Decoding a JWT Token
Use the following command to decode a JWT token:
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" | base64 -d | jq
What This Does:
- Extracts and decodes the Base64URL-encoded JWT components.
- Uses `jq` for JSON formatting.
2. Exploiting “None” Algorithm Vulnerabilities
Some JWT libraries accept tokens with the `alg` field set to none, allowing attackers to bypass signature verification.
Crafting a Malicious JWT
Modify the header to:
{
"alg": "none",
"typ": "JWT"
}
Then, remove the signature and submit the token.
Step-by-Step:
1. Decode the original JWT.
2. Change `alg` to `none`.
3. Re-encode the header and payload in Base64URL.
4. Submit the token without a signature.
3. Cracking Weak JWT Secrets
If a weak secret (e.g., secret, password) is used, attackers can brute-force it.
Using John the Ripper
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" > jwt.txt john --wordlist=/usr/share/wordlists/rockyou.txt jwt.txt
What This Does:
- Attempts to crack the JWT secret using a wordlist.
4. Injecting Malicious Claims (Kid Manipulation)
The `kid` (Key ID) parameter can be abused if improperly validated.
Exploiting File Path Traversal via `kid`
Modify the JWT header to:
{
"alg": "HS256",
"typ": "JWT",
"kid": "../../../../../../dev/null"
}
Impact:
- Forces the server to use a null key, potentially bypassing validation.
5. Testing for JWT Expiration Bypass
If a JWT lacks proper expiration checks, it can be reused indefinitely.
Verifying Token Expiry
Check the `exp` claim in the payload:
echo "PASTE_JWT_HERE" | base64 -d | jq '.exp'
Mitigation:
- Always validate `exp` and `nbf` (not before) claims.
What Undercode Say:
- Key Takeaway 1: JWT vulnerabilities often stem from misconfigurations, not cryptographic flaws.
- Key Takeaway 2: Automated tools like `jwt_tool` can streamline testing, but manual analysis is crucial.
Analysis:
JWT security depends heavily on implementation. Developers must enforce strict algorithm whitelisting, strong secrets, and proper claim validation. Ethical hackers should focus on real-world testing, as seen in Faiyaz Ahmad’s video, where practical exploitation led to a valid bug bounty find.
Prediction:
As JWTs remain a standard for authentication, misconfigurations will continue to be a prime target. Future attacks may leverage AI-driven JWT manipulation, making automated defense mechanisms essential.
Ready to test your skills? Try hunting for JWT flaws in bug bounty programs or CTF challenges! 🚀
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Faiyaz Ahmad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
