https://whguswo.github.io/tags/jwt/Recent content in JWT on whguswoHugoko-KRSun, 14 Jul 2024 00:00:00 +0900https://whguswo.github.io/posts/jwt-confusion/Sun, 14 Jul 2024 00:00:00 +0900https://whguswo.github.io/posts/jwt-confusion/<h2 id="refer">Refer</h2> <p><a href="https://portswigger.net/web-security/jwt/algorithm-confusion#deriving-public-keys-from-existing-tokens">Portswigger Document</a><br> <a href="https://velog.io/@thelm3716/JWTvul#%F0%9F%A9%B8-exploitation-2">JWT vulnerability🩸</a></p> <h2 id="info">Info</h2> <p>This Problem is JWT confusion.</p> <p>RS256 uses an asymmetric key, a private key for generation, and a public key for verification.</p> <p>HS256 uses public keys for both token creation and verification. By using the difference between the two, authentication can be bypassed by extracting the public key of RS256 and creating a token with HS256 when verifying both methods.</p> <p>Key extract : <a href="https://github.com/silentsignal/rsa_sign2n/tree/release/standalone">https://github.com/silentsignal/rsa_sign2n/tree/release/standalone</a></p> <h2 id="exploit">Exploit</h2> <p>After Extract key, you can sign JWT as You Want.</p>