webPromedium
Lab 288 — VaultPay — 2FA Bypass via Pre-Authentication JWT
hackadvisor
Task: banking platform with 2FA that issues JWT before OTP verification, containing otp_verified:false claim. Solution: use pre-authentication JWT to access API endpoints that don't validate the otp_verified claim, retrieving flag from account settings.
$ ls tags/ techniques/
jwt_analysisapi_endpoint_enumerationpre_authentication_token_abusemissing_authorization_check
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 301 — VaultLine — 2FA Bypass via Rate Limit Evasion— hackadvisor
- [web][Pro]Lab 354 — VaultAPI — JWT Authentication Bypass via JWE-Wrapped PlainJWT— hackadvisor
- [web][Pro]Lab 341 — KeyVault2FA — SSRF via OTP Account Import— hackadvisor
- [web][Pro]Lab 215 — NestVault — 2FA Bypass via Incomplete Session Verification— hackadvisor
- [web][Pro]Lab 350 — VaultKeeper— hackadvisor