webPromedium

DataVault Insights

hackadvisor

Task: Express.js analytics platform with JWT API authentication and role-based access control (viewer/admin). Solution: Forged JWT with alg:none to bypass signature verification, escalated role from viewer to admin, accessed /api/admin/config to retrieve flag from PLATFORM_SECRET_KEY.

jwt nodejs authentication_bypass none_algorithm token_forgery privilege_escalation decoy_flag role_based_access_control express_js

decoy_flag_identificationapi_endpoint_enumerationrole_based_access_control_bypassjwt_alg_none_signature_bypassprivilege_escalation_via_forged_claims

$ ls tags/ techniques/

jwt nodejs authentication_bypass none_algorithm token_forgery privilege_escalation decoy_flag role_based_access_control express_js

decoy_flag_identificationapi_endpoint_enumerationrole_based_access_control_bypassjwt_alg_none_signature_bypassprivilege_escalation_via_forged_claims

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups