webPromedium
DataVault Insights
hackadvisor
Task: Express.js analytics platform with JWT API authentication and role-based access control (viewer/admin). Solution: Forged JWT with alg:none to bypass signature verification, escalated role from viewer to admin, accessed /api/admin/config to retrieve flag from PLATFORM_SECRET_KEY.
$ ls tags/ techniques/
jwtnodejsauthentication_bypassnone_algorithmtoken_forgeryprivilege_escalationdecoy_flagrole_based_access_controlexpress_js
decoy_flag_identificationapi_endpoint_enumerationrole_based_access_control_bypassjwt_alg_none_signature_bypassprivilege_escalation_via_forged_claims
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 354 — VaultAPI — JWT Authentication Bypass via JWE-Wrapped PlainJWT— hackadvisor
- [web][Pro]LeadVault— hackadvisor
- [web][Pro]Lab 316 — InsightForge — JWT Secret Leak to RCE via Command Injection— hackadvisor
- [web][Pro]Lab 328 — DataNest — NoSQL Operator Injection in Authentication— hackadvisor