JSON Web Token Vulnerabilities

JSON Web Tokens (JWT) are becoming very common for authentication and authorisation these days. In this video, I show you how to bypass their signature checks in weak implementations.

~~~
This is an educational video, gain permission from target owners before attempting anything from this tutorial. By not doing so, you risk being penalised by the computer misuse act or equivalent in your country
~~~

0:00 Introduction
1:18 Sensitive Data/Expiry
2:36 Vulnerable JWT Lab
3:07 JWT None Attack
6:30 JWT Signature Not Checked
7:54 Key Confusion
10:44 Weak Signature Brute Force
12:37 kid Attack
15:46 Outro

Don't forget to subscribe and like the video for continued Cyber Security viewing!

[Cossaw]

I was literally doing a box earlier with this struggling to remember what I needed to do haha! Big fan of your content :)

[cybersecurehacks]

Awesome job dude... This is what I was looking for.. Holy molyy . WOWWWW

[giovanniannunziata]

i dont understand why i get invalid token in the key confusion attack, i did exactly your same steps. maybe its an error with the publickey.txt? i just copied the key on the site in a txt file. another thing that i think its a mistake its what i do when i copy the token i get from jwt tool into the cookie extension: i just copy the token there, save and then refresh the page. what am i missing?