Cracking JWTs: A Bug Bounty Hunting Guide — Part 2
1 min read
Summary
Web applications often use JSON Web Tokens (JWTs) as a way of maintaining sessions and identifying users.
However, these tokens are only as secure as their implementation, and if certain guidelines are not followed correctly, they can be a vulnerability goldmine for attackers and bug bounty hunters.
This article is part of a series focusing on different ways in which JWTs can be exploited, specifically through bypassing authentication by brute-forcing a weak symmetric signing key and forging a valid admin token.
It provides a step-by-step exploit walkthrough, demonstrating how a vulnerability in the lab can provide admin access by deleting Carlos (the usual suspect).
The article also highlights the real-world relevance of the issue, noting that JWTs are often poorly implemented, which can lead to serious authentication bypasses and full application compromises.