webProhard
Та самая заметка (That Same Note)
hackerlab
Task: Access John Doe's notes in a notes service with JWT authentication. Solution: IDOR via Header Injection - the server accepts Firstname/Lastname from HTTP headers instead of JWT claims, allowing identity spoofing.
$ ls tags/ techniques/
idor_via_headersjwt_analysisapi_enumerationheader_manipulation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Заметки (Notes)— hackerlab
- [web][Pro]UUIDY— duckerz
- [web][Pro]Лысина админа (Admin's Bald Head)— duckerz
- [web][Pro]Разминка с JWT (JWT Warmup)— hackerlab
- [web][Pro]rigidType— hackerlab