webPromedium
Lab 316 — InsightForge — JWT Secret Leak to RCE via Command Injection
hackadvisor
Task: Express.js BI platform with a JWT secret hardcoded in client-side JS and an admin test-connection endpoint passing a hostname into a shell ping. Solution: leak the HS256 secret from /js/auth.js, forge an admin JWT, then OS command injection via the hostname field for RCE as root and read /root/flag.txt.
$ ls tags/ techniques/
command_injectionpingrcejwtnodejsinformation_disclosurehs256privilege_escalationhardcoded_secretalpine_linuxexpress_jsjwt_forgerydecoy_flagsclient_side_secret_leak
decoy_flag_identificationshell_metacharacter_injectionjwt_forgery_hs256jwt_secret_leak_in_client_jsadmin_role_privilege_escalationos_command_injection_via_hostnamerce_as_root
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 252 — BuildForge — RCE via npm Lifecycle Script Injection— hackadvisor