JSON Web Token Hacking

// Membership //

// Courses //

// Books //

// Social Links //

// Disclaimer //
Hacking without permission is illegal. This channel is strictly educational for learning about cyber-security in the areas of ethical hacking and penetration testing so that we can protect ourselves against the real hackers.

[redmatrice]

Correct me if i'm wrong! but the main reason for using the JWT is to verify the user without the need to connect a database and compare the values? and also changing the values of the payload misses completely the signature, which already encrypted with secret key and should be rejected in the first place, if someone uses the JWT without verifying it somehow in their website he shouldn't use JWT at all, it's like giving access to everyone and trusting blindly every user!!

Steps as far as i know :
1 - get the JWT
2 - verify the signature by decrypting it using the secret key (the most important), exp ...
3 - proceed to the next step (perform any action you need)

if 1 fails, reject everything
if 1 doesn't fail and 2 fails reject everything
if 1 and 2 doesn't fail now you can go to the step three and perform the action

[COLMANRYAN]

Brother, I love all your videos. They are concise, quick, no bullshit, no music and you could not have done a better job.

[JanRautiainen]

Interesting technique, another scenario to add to my vuln checking, thanks for sharing

[dmitriylevy]

how did key-id with sql query from some table that gives you no useful information, give you the authorization to delete user?
server side key id targets nothing and server does not throw an error so then it authenticates you?

[zzsql]

Good brief, Loi. Thanks. I touch on this subject for the PenTest+ class I teach. Useful content here.

[md.riyasathossain]

Sir Loi, it was a great hacking tutorial! But now the thing is, how can "we" secure our JWT tokens and the websites using JWT?

[FabulousFitsFantasy]

is it mean you have to know the server containing the key first?

[VineetYadav]

While this is good one, it very much depends on dal layer which is by default prevented by dal fw.
Also someone using jwt must be using some sort of lib, and not.directly doing jwt implementation. So might not be taht much practical in real world....
Not sure if there is some one that idiot in real world.who queries SQL directly.

[Peterb]

I've also done this once in a CTF by setting the algorithm to none :D

[Abasalt_Yar]

Hello, Thanks for the video. How can we prevent this ?

[Sonictag]

Hey how did you learn to hack, like any courses or like college ?

[hackerxploit]

U always have good vids! 👏 Keep going!

[MuhammadAli-zgnw]

every website encrypt token different with different algorithms. I tried that website and it didnt tell me token information.

[sto]

1:18 - "We're trying to remove the cats account"... That sounds so wrong lmao

[benjaminargueta]

How would you protect against this attack?

[rainfallen]

I'm a bit confused. I thought the whole purpose of the JWT being secure is that the token CAN'T be manipulated (without knowing the private key). When the KID property, EXP property, etc. was changed, I would assume the the server will immediately reject it because the signature would no longer match. Or is the JWT token being used differently in this example?

[aburahan]

Is it possible to hack if MongoDB is being used?

[littleguardian]

Sir, How do i watch member only content?

[lakshaynz]

how did you know which table you needed to insert into ?

[Uneke]

How did you know the location? Usually I’ve had to run sql multiple times to escalate ad find location names.