JWT Authentication Bypass via jwk Header Injection

[@logan0x]

why the tempered jwt has the jwk parameter set with all it's claims but the original one does not have

[@intigriti]

Hey, can you timestamp the section of the video so I can review? 😁

[@logan0x]

@@intigriti at 5:15 when you decoded the jwt it shows that there is a "kid" claim in the header , but at 10:24 you embedded the whole "jwk" parameter not just the new "kid"

[@melegritojoel]

Nice work

[@intigriti]

Thank you! 😊

[@bugbountyicodeidc981]

good work

[@intigriti]

Thank you! 🙂

[@anonymousvevo8697]

nice video, just small remark if you may, the sound quality makes it a bit complicated to follow along with the explanations

[@intigriti]

Thanks! Can you be more specific on the sound quality? This is the first comment I've seen to say it's bad, most comments talk about how clear and crisp it is 😕

[@anonymousvevo8697]

@@intigriti i never said your video is bad nor i meant a bad comment, it’s just when you start most of your sentences the first two-three words get cut, i don’t know if it’s just me ? But thanks for the efforts really appreciate it

[@intigriti]

No problem! 🥰 I just want to try and confirm if there's an issue.. I haven't noticed that before or had any similar reports. Can you give me timestamp as an example so I can check? Maybe also test with another device if possible 🙏

[@anonymousvevo8697]

​@@intigriti Yes you are right i've tried using my phone , only on my laptop, it comes from me, idk why, Thanks anyway for the reply wish you best of luck

[@felipesilva3862]

Method with Burp this error for me , The signature key was not found, Please help me?i pad!

[@intigriti]

Hey, please double check the video - it was recorded recently so unlikely anything has changed!

[@felipesilva3862]

@@intigriti Could you give me a way to contact you directly, I'll pay!

[@g30rgyth3d4rk]

Really cool 💥❤‍🔥 i didn't know of this attack. I have learned something to add to my thought process😊.

[@intigriti]

Awesome! 👏

[@MichaelCooter]

Greet stuff

[@intigriti]

🙏🥰

[@csstestusr]

Hi Sir, how to exploit php 8.2.0?

[@intigriti]

Hi there! Best thing is to check CVE databases and vuln scanners e.g. snyk to see what known vulnrabilities exist. Next, look at the specific details for those vulns to find out what the requirements are, and whether they are exploitable in your specific scenarios. Couple of links: www.tenable.com/plugins/nessus/168500 + vulners.com/nessus/WEB_APPLICATION_SCANNING_113581 but bare in mind that newer versions of PHP are less likely to be vulnerable, often you'll be better off focusing on application specific implementation, e.g. look for vulnerabilities in the code/features of the website, rather than the underlying libraries.

[@csstestusr]

@@intigriti thanks 🙏

[@mohmino4532]

nice work and can u give us that script plz 😊

[@intigriti]

Added the scripts here, so you can follow along 😉 github.com/Crypto-Cat/CTF/tree/main/web/WebSecurityAcademy/jwt

[@mohmino4532]

@@intigriti thanks ❤