webeasy

Лысина админа (Admin's Bald Head)

duckerz

Task: Bypass server protection to become admin. Solution: Crack JWT HS256 secret key using hashcat with rockyou.txt wordlist, then forge admin token to access the flag endpoint.

$ ls tags/ techniques/
brute_forcejwthashcattoken_forgeryauthentication
jwt_crackingjwt_forgerywordlist_attack
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]