hunt-jwt-crypto

1# HUNT-JWT-CRYPTO — Forgeable JSON Web Tokens (A04 Cryptographic Failures)
2 
3## What actually pays
4 
5A JWT is `header.payload.signature`, each base64url. The signature is the only
6thing stopping you from editing the payload (your identity/role) and replaying
7it. It pays **High/Critical** when the verifier can be tricked into accepting a
8token you forged — so you become another user or an admin without their secret.
9 
10Two classic, generic verifier flaws:
11 
12- **`alg:none`** — the verifier trusts the token's own `alg` header. Set
13  `alg:"none"`, drop the signature, edit the payload (e.g. `role:"admin"`,
14  another user's `id`/`email`). A broken verifier skips signature checking.
15- **RS256 → HS256 key confusion** — the token is signed RS256 (asymmetric). The
16  RSA **public** key is, by definition, public. If the verifier lets you choose
17  HS256, it will use that public key as the HMAC *secret* — which you also know.
18  Sign an edited payload with HS256 using the public key and it validates.
19 
20## Recon — is this app JWT-based?
21 
22```
23Login/token responses containing  "token":"eyJ..."   or  Set-Cookie: token=eyJ...
24Authorization: Bearer eyJ...    on authenticated requests
25A JWKS / public-key endpoint:   /.well-known/jwks.json, /jwks, public-key in the JS bundle
26```
27 
28Decode the header (base64url the first segment). `"alg":"RS256"` → try key
29confusion. Any alg → always try `alg:none` first; it's free.
30 
31## Forging the token (never hand-encode base64 — use a JWT tool)
32…