How to Exploit 'Json Web Token'(JWT) vulnerabilities | Full Practical

JSON Web Token (JWT, RFC 7519) is a way to encode claims in a JSON document that is then signed. JWTs can be used as OAuth 2.0 Bearer Tokens to encode all relevant parts of an access token into the access token itself instead of having to store them in a database.

:::::::::::::::::::::::::::::::::::::::::::
00:00 - intro
00:12 - What is JWT?
01:19 - None Algorithm Vulnerability
01:45 - Practical : None Algorithm Vulnerability

02:30 - RS256 to HS256 Vulnerability
03:04 - Practical : RS256 to HS256 Vulnerability
05:32 - Weak JWT Signature
07:08 - Conclusion

:::::::::::::::::::::::::::::::::::::::::::

[LinuxSploitOfficial]

Become Part of LinuxSploit by clicking SUBSCRIBE button <3

[corpsecoder]

This is awesome you went into depth on how Jwt works thank you

[marshal_demi]

Thanks, Boss. The first part helped me in a CTF

[sushantkamble]

Superb explanation bro need more videos on these critical bugs 👍🏻

[jerrytech]

thanks, man....waiting for more videos like this...

[dr_tomato]

When i write the same python code 4:09 in Window i get another output . Idk why ! :(

[vishalkothari]

Where can we get the public key in order to get the admin token ?

[grgnizz]

great content, subscribed, hope to see the same quality content

[smandoece]

Thank you for your video, it is really helpful! If we want to make the python script appropriate for RS256 algorithm encryption, not HS256, what modules should we use and how should we modify the code in order to produce the corresponding signature? Thanks a lot.

[macspexs]

Are there any online websites or tools that can convert RSA to HMAC JSON Token

[healthplus]

Please Can you host the code that used to crack the jwt ??

[borderline]

impossible to watch with annoying robot voice