hunt-jwt-crypto

# HUNT-JWT-CRYPTO — Forgeable JSON Web Tokens (A04 Cryptographic Failures) ## What actually pays A JWT is `header.payload.signature`, each base64url. The signature is the only thing stopping you from editing the payload (your identity/role) and replaying it. It pays **High/Critical** when the verifier can be tricked into accepting a token you forged — so you become another user or an admin without their secret. Two classic, generic verifier flaws: - **`alg:none`** — the verifier trusts the token's own `alg` header. Set `alg:"none"`, drop the signature, edit the payload (e.g. `role:"admin"`, another user's `id`/`email`). A broken verifier skips signature checking. - **RS256 → HS256 key confusion** — the token is signed RS256 (asymmetric). The RSA **public** key is, by definition, public. If the verifier lets you choose HS256, it will use that public key as the HMAC *secret* — which you also know. Sign an edited payload with HS256 using the public key and it validates. ## Recon — is this app JWT-based? ``` Login/token responses containing "token":"eyJ..." or Set-Cookie: token=eyJ... Authorization: Bearer eyJ... on authenticated requests A JWKS / public-key endpoint: /.well-known/jwks.json, /jwks, public-key in the JS bundle ``` Decode the header (base64url the first segment). `"alg":"RS256"` → try key confusion. Any alg → always try `alg:none` first; it's free. ## Forging the token (never hand-encode base64 — use a JWT tool) Use a purpose-built tool ...