webeasy

Web Center

hackerlab

Task: a Flask/Werkzeug site used an HS256 JWT in a cookie for authentication and stored the user's role directly inside the token. Solution: recover the weak signing secret, forge an admin token, and send it to /admin to escalate privileges and reveal the flag.

$ ls tags/ techniques/
flaskjwtwerkzeugtoken_forgeryhs256privilege_escalationweak_secretrole_based_access_control
jwt_secret_bruteforcerole_escalationjwt_token_forgery
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]