webhard

Та самая заметка (That Same Note)

hackerlab

Task: Access John Doe's notes in a notes service with JWT authentication. Solution: IDOR via Header Injection - the server accepts Firstname/Lastname from HTTP headers instead of JWT claims, allowing identity spoofing.

$ ls tags/ techniques/
jwtauthentication_bypassheader_injectionidorapi
idor_via_headersjwt_analysisapi_enumerationheader_manipulation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]