ATTACKING JWT FOR BEGINNERS!

[@FarahHawa]

The burp extension, code to change the signature and the lab which was used are all linked in the description!

[@kunalraut1689]

But what if the server doesn't accepts the request made to it having the Symmetric Algorithm(parameter) or doesn't accept any altered requests and just neglects it. Then its of no use for us to alter the 'alg' to something else and we have to deal with it the way it excepts(Asymmetric Algorithm)? And btw well explained! Thank You.

[@afifmalghani755]

Once again, the best beginner friendly content out there. Keep it up.

[@thecoder7984]

Farah your are an role model and example of millions of Indian women.👍👍👍

[@MattiaCampagnano]

As a pentester, I tell you you girl rock. Well done, keep up the good work!

[@yrks1109]

Just don't stop these kind of Videos about Cyber security, as a Beginner myself I rely on KZbin for gathering 98% of knowledge, so thanks for giving us a video like this! Keep it going! 👍👍🔥

[@jatindersingh7047]

Just wanted to drop some appreciation your way! Your content has been an absolute lifesaver for beginners diving into the world of cybersecurity. I would love to see more videos on web vulnerabilities and diving deeper into those crucial interview questions which are not very common, but frequently asked in the interview. Keep up the fantastic work!" :)

[@manikgoenka8720]

Just randomly crashed into this channel yesterday and now I am a subscriber........you are doing a great job Farah.......looking forward to explore this field.

[@adryelgainza1686]

Awesome! Lots of videos showed how to do it but they did not explain the vulnerability like you. Thank you!

[@Abiishek]

Welcome Back 🙌 Stay positive!!

[@shwetakalkhair1206]

M currently doing a project in my office.. they using JWT.. this was actually helpful for testing JWTs.. thank u 🙂

[@whitehat3937]

Hy please don't stop making videos. You are doing great job. I want indian women also be a part of this community 🙂

[@monishpalanikumar]

You've given a precise and beginner friendly tutorial.. thank you so much Farah ! 🤗

[@haksting]

10/10 Awesome quality of video Very informative Nic editing 👍

[@corporatemurrell]

What an amazing video! Great music and sound effects, superb graphics and editing, fresh technical content in a bite sized package, and such a pleasant voice. You're setting the bar really high, and I hope you continue you to do so! Good job!

[@Unhacker]

Good stuff, one of the better JWT hacker vids. Another interesting angle to explore is JWTs as an injection/RCE vector, completely outside the context of bypassing authentication. Good times.

[@jissjose1382]

The best video 👌 out there.Looking forward for more attacks and contents from you..

[@yajusgakhar6969]

Thanks to you I could complete a challenge that had been bothering me. Cheers!

[@ElektroDrrrEL]

content is super high quality - thank you, Farah!

[@mal0931]

very good vid this helped me complete a hack the box, very good explanation to.

[@erezlevi5411]

That's really really helpful and easy to understand! Thank you!

[@pastryelite1440]

Nice video with Great Explanation... looking forward to watch more videos....🥳

[@tirtheshpawar1020]

One humble request, please try and make a full playlist covering bug bounty hunting concepts with attacks, it can be a series of videos maybe 1-2 videos per week.You pitch your content really well. God bless you!

[@AryanPant2004]

Thank you thank you thank you mam , please keep on teaching

[@pranayhusukale2666]

Explanation is top notch.

[@himanshushah9471]

Please make video on Beginner guide to cybersecurity/ethical hacking and all stuff like scope, carrier, programming languages, Basics,Certification, what to Learn and where?,Resources, etc...

[@himanshushah9471]

Also make video Your CEH journey

[@fypage.]

Your way more interesting than most teachers probably because you so young I would expect you to know much so that's good

[@raanonyms7926]

wow, you are doing awesome. please keep on posting such walkthrough.

[@sameerkeeran9679]

I love you and your teaching ❤️👍🙏

[@AasdKareemKorejo]

Thank you Farah for this useful videos but please also suggest us what is recommended way to use.

[@amishmane]

Thanks Farah. Just a suggestion that a zoomed coding screen would really be helpful.

[@vijaySingle143]

Huge respect Farah , thank you .

[@FarahHawa]

you're welcome 😇

[@darshanjogi5781]

Useful video please make full playlist on how to use burpsuit.i think You explain it better than others

[@PavanKumar-hd2cf]

Thank you so much for clear explanation.. 😊👍

[@alexmridul2403]

Yeah That's what a content creator

[@jashan8636]

You're the best. I'm beginner in cybersecurity and I was wondering if anyone could help me where to start. Your videos gave me some direction. carry on👍👍👍

[@urrahman196]

Great tutorial I must say. Could you Please make a guideline type or learning path type video to Start in Cybersecurity field. What are the topics and which resources should follow as a beginner? Thanks

[@kamar1380]

Again Thank for this awesome video...👍 Pls don't stop making such a awesome video..

[@alexmridul2403]

It's great Really OP I love the way you teach

[@czemuklown]

hello you helped me with ctf tournament thank u very much love ya

[@mscor4ever139]

great work , you deserve the best

[@rohitblaze9015]

Your video is really good for beginner but can you go a little slow and a bit more description? Then it would be perfect.

[@comedybuzz6629]

please create a video on how to set up burp suite with android and intercept loved this video :)

[@haskellscript]

Great content. I've noticed that you blink a lot on this vid. As a suggestion it'd be nice to bring a vid about the tools you use/like/recommend like the one on this vid.

[@tahan1tonmoy]

Very basic attacks but nicely explained 👍

[@techrims3908]

Really Great Information Farah Didi | Thank You So Much | 💝🙏💌

[@danielgrunberger2621]

I absolutely love ur videos !! Greets from Brazil

[@roshanrajkumar7827]

Amazing...but it’s too fast..I got few doubts ...how can I contact?

[@ilyasayusuf5447]

Is the header really important ? I mean why would they show the attacker the alg they are using. Maybe make the signature unpredictable like this? hs256(bs64url(fakeheader)+secretkey+bs64url(body)+bs64url(secretkey),secretkey); am i doing it better or it is bad practice?

[@fenilfaldu8740]

I love your content, but can you make a video on nftoken

[@theprateekmahajan]

Hey farah, Great of you. Would you make a video on your journey till today for the very begginers who wants to Kickstart their career.

[@parthibanakt7090]

Great and simple..!

[@gilbertolopez5894]

Thanks for dedicating content for beginners !! You are my hero, I want to be just like you when I grow up :)

[@bheeshamkumar1186]

Thanks for video it is really nice and simple to learn. Keep it up...

[@MdSajid-fb9ul]

Explained very well. Hats off

[@faysalahmed7251]

Gr8 job, keep it up

[@sharathputta1703]

Please continue to post new things you are learning. I could see interesting stuff in your channel. please keep on post new things

[@dhruvkandpal9909]

Great job! Really learning a lot out here. Keep up the good work! Happy hacking!

[@swapnilpawar2311]

Simple Explanation, Good video

[@hackerproxy19]

Hello Farah you make video (Subdomain Takeover Attack) i'm waiting for your next video

[@alialmasslmany5240]

thank you so much farah

[@b3ast407]

Thanks Farah!! Learnt something new

[@carlosmonterrosa4617]

Nice video. Respect!!

[@urssaf343]

Said scenarios are not realistic in production. Who implements jwt and doesnt verify signature ?

[@muhammedsillah111]

keep up the good work really love the video

[@sail6114]

Good one, finally I understood the concept 👍

[@martinosaidimussa5813]

i really enjoyed your stuff , stay positive

[@bharathpatel1757]

Thanks for this . And really it's helping me alot as a beginner .

[@MehediHasan-rc1lo]

No such file or directory: 'public.pem' error generate from your script. How can I solve this error?

[@gamebuzz723]

you explained very precisely

[@reallyunnecessaryuser]

Hey, I have a question. What do you do when you find a site using HS256 algo, do you suggest them to go for RS256 or just let it be?

[@SahilKumar-ww7xn]

All right but can you tell me how to change the token manually plz becoZ we don't have option which you used in your burp suite.Thank u

[@FarahHawa]

You can download the extension. I have mentioned the link for it in the description.

[@SahilKumar-ww7xn]

@@FarahHawa but how we add it on burp suite in kali Linux.

[@FarahHawa]

@@SahilKumar-ww7xn Use the Extender tab

[@SahilKumar-ww7xn]

@@FarahHawa Thanks a lot. Waiting for next vedio 😍🤟

[@viveksdf]

Hello Farah, Great video I would love to watch more this kind of content and a video how you started in this field a journey video would be great

[@apnimashoori2762]

how to find the hs256 key ?

[@ZaidKhan-nk7xr]

Please make a tutorial on Burp Suite

[@soniamalik4929]

Keep growing di

[@swapnildevkate5112]

Love from far, from ethical learner

[@vijaykannanhere]

Keep it up Farah!

[@souhaillepacifique7572]

Great video thank you 💝🇲🇦 following you from Morocco ✌ keep it up

[@angeldev96]

I love you content, we learn a lot from people like you. Hope to be a great bug hunter someday ^^

[@anuragbhoir8516]

Well this is very helpful ❤️ thank you and waiting for your next video

[@mr_ehmed]

i am not able to modify tokken through JSON Web Tokens extension :/

[@slbpriank91]

You are legend! Hopefully one day i can be good and work together with you

[@hassan12141]

Great content but Why u don't upload videos regularly

[@meljithpereira5532]

Make more videos farah

[@desafiotic5477]

Muchas gracias, gran video, me ayudo mucho.

[@asnyeamin5766]

This video is really beginner friendly...❤ Already feels like i become a hacker..haha Bt Can you please add subtitle in your videos??? That will be really helpfu.. And thanks a lot..

[@ThePomelo09]

Ty +1 subscriber! Hi from Argentina.

[@ishanpatel8386]

Hey farah, I hope you're doing well. I just wanted to ask one small thing which is confusing me, JWT are used for "authorisation" which means after we're logged in it is used to check if we're the same user which logged in vis "authentication". So my question is you used jwt authentication in your thumbnail but jwts are used for authorisation, I just want you to clear this confusion because I think I'm missing something

[@rachitjain5008]

Thanks Farah...

[@feynman8692]

thanks ma'am this helped a lot 👍 plzz make such video's and ignore false comments we badly want your help and videos 🙏

[@matitanium]

how i can export publickeey with .pem format in webpage? pls answear

[@PrasadMhatre]

Good tutorial

[@flowwithmusic787]

Very well explained. ✌

[@we_the_people_of_kashmir3534]

Hey farah. New subscriber to your channel. I just started cybersecurity and ceh. Where should I start from. Any suggestions please

[@amansanghai1201]

Hey, are you doing all this in windows or in Linux? It seems like you r using windows

[@IdrisKhan7]

Hi Farah, I'm a beginner to Burp Suite. How did you get the JSON Web Token Tab in your intercept.?

[@IdrisKhan7]

Ok I found it in the description, will try that

[@vaibhavgaikwad4291]

Great.... it was sooooo helpful :)

[@vaibhavgaikwad4291]

Mam please accept my LinkedIn request i have some doubts

[@simranpreetsingh5502]

Hi Farah, That was an amazing video ! Just out of curiosity is there a way we can know how session ID's are generated by bruteforcing or any other means, any help around this would be helpful ! Thanks much :D

[@faysalahmed7251]

Very good tutorial,

[@shubhamojha6572]

Nice and beginner friendly