webPromedium
Lab 350 — VaultKeeper
hackadvisor
Task: VaultKeeper enterprise secrets management platform uses RS256 JWT authentication with exposed public key. Solution: JWT Algorithm Confusion attack (CVE-2016-10555) — changed alg from RS256 to HS256 and signed with the RSA public key as HMAC secret to forge admin token.
$ ls tags/ techniques/
jwtnodejsauthentication_bypasstoken_forgeryhs256expressprivilege_escalationalgorithm_confusionrs256cve_2016_10555
jwt_algorithm_confusionhmac_with_public_keydecoy_flag_identificationrole_based_access_control_bypassjwk_to_pem_conversion
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 354 — VaultAPI — JWT Authentication Bypass via JWE-Wrapped PlainJWT— hackadvisor
- [web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
- [web][Pro]Lab 12 — NewsGrid — JWT Algorithm Confusion— hackadvisor
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 288 — VaultPay — 2FA Bypass via Pre-Authentication JWT— hackadvisor