JSON Web Keys (JWK & JWT) - 'Emergency' - HackTheBox Business CTF

[ozhipxe]

I love it when u do the "WHY?"

[joeymelo]

John: “Man, I’m falling apart”
Everyone: We’ve all been there John. We’ve all been there.

Thanks for the video:D

[alexlefevre]

Every time, every video, I learn... I learn a TON. I earned my CS degree in 2012, which is for all intents and purposes, one complete stage of evolution of the field. I missed streamlined AI/ML, as they were all electives that required department approval. I also missed in depth server side scripting such as JSON, but we DID do a lot of PHP and our main focus coding wise was C++.

We learned nothing pertaining to pentesting or security measure beyond solutions offered in a basic web portal when one purchased hosting.
We did an oddly large amount of assembly, as well.

I've learned more about security, malware, and generally understanding what you present here than a 4 year degree. You are awesome and have a forever subscriber.

[Dygear]

Actually super helpful to me. I have to use JWTs and I didn't understand them at all. This helped so much and allows me to avoid a pitfall of them as well.

[cheezedoodles]

I enjoy these ctf videos so much! Thanks for the content John, keep these daily uploads!

[matteoleone]

I really liked the première! I think this will be really useful in many occasions. Thanks John!

[kyand]

This for some reasons gave me a pico ctf challenge flashback that john did, it involved JWT

[TheOcta]

I hope in the future to solve things like you do, great job John!

[gokoo]

@18:31 you killed gunicorn again after killing it near minute 18, but you didn't kill nginx either time :D

[kylefaust]

I have been studying networking for the last month and I still have Zero clue what he does with these videos but I am DETERMINDED to figure it out so I can not only follow him on videos but also Solve these problems myself!!! Thanks for the video! loved your cast on HTB battelgrounds and here's hoping for more!

[jocsamisrraine]

Good one, still watching from Brazil in 2023

[chippyswoodworking]

Great video. I learn a lot from your channel.

[tehvvisard]

Depending on how the check is setup on the server side you might just have been able to create a new token with username: admin. Not all apis check the signed part only that the jku matches

[zombie]

Great video as always!, much love man <3

[pengrey]

John this one was a bit confusing to follow, maybe next time some more slow pace. But loving this series keep on o/

[dedkeny]

Python4... I just stared into the eyes of the future!

[DizzySpark]

Weird question... was the "rogin" screen sanitized?

[Maik.iptoux]

Minute 15: alg, alg, alg!!! Something you don't see the things in front of your eyes 👀😂

[xXReVo_LuTiOnXx]

Why does Jwt allow this behaviour ?
I mean there should be some strict content Policy like "JWT" can only be checked to a domain which it is used by or something, everything else is really stupid isn't it ?

[MaZe]

whats the main takeaway? how come the jku location can be changed to anything? please talk about what the vulnerability was here - just human error?