webPromedium
Lab 12 — NewsGrid — JWT Algorithm Confusion
hackadvisor
Task: News CMS with JWT-based authentication where role is stored in token claims; admin config endpoint requires admin role. Solution: Forge JWT with alg:none and role:admin to bypass signature verification and access the admin configuration API containing the flag.
$ ls tags/ techniques/
jwtnodejsauthentication_bypasstoken_forgeryhs256privilege_escalationrole_bypasscmsalg_nonehoneypot_detection
jwt_token_forgerydecoy_flag_identificationjwt_none_algorithm_attackrole_based_access_control_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
- [web][Pro]Lab 350 — VaultKeeper— hackadvisor
- [web][Pro]Lab 354 — VaultAPI — JWT Authentication Bypass via JWE-Wrapped PlainJWT— hackadvisor
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor