JSON Web Token Attacks: LAB #3 By PortSwigger - JWT Authentication Bypass Via Weak Signing Key

[@emanuelepicariello]

Please Leave A Like And Eventually Subscribe

[@chromecast8368]

Nice buddy thanks for helping!!

[@emanuelepicariello]

Thanks, glad to help😁

[@acronproject]

Thanks for this

[@emanuelepicariello]

You are welcome!

[@MrDarkX4]

hey bro.. you're doing it great. but can you tell me how to sign a key using BURP suite for the above case. really appreciate it

[@emanuelepicariello]

Hi Anuj, Thanks for the message. If you want to solve it through Burp Suite, after you’ve found the secrect key with hashcat, you go to the JWT Editor Keys tab. Here, you need to generate a new key with the option “New Symmetric key”. Chose a random size and click generate. Modified the value “k”:{your-secret key }. Last step, intercept the login request with Burp Suite, change sub to ”administrator” and sign the JWT with the previous symmetric key Last step, intercept the login request with Burp Suite, change sub to ”administrator” and sign the JWT with the previous symmetric key created. I hope this is clear😁.

[@MrDarkX4]

@@emanuelepicariello thanks man. I may tag you in ur other videos for help.

[@emanuelepicariello]

@@MrDarkX4 yes sure, you’re welcome to do it😁