Cracking JWT: a tale of magic, Node.JS and parallel computing
summary
Demo shows a working distributed JWT brute‑forcer that uses Node.js clients coordinated by a server over ZeroMQ to iterate secrets for HS256 tokens. Implementation uses an integer‑to‑string bijection, batch cursor allocation and a publish/subscribe stop signal; four clients crack a 5‑char secret (“pizza”) in minutes. Attack proves weak symmetric secrets are practical to break; recommended mitigations are long random secrets or switching to RS256 (public/private keys).
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 2:36What is a JWT token
- 11:08Building a JWT from scratch
- 13:39When to use JWT tokens
- 20:21JWT security pitfalls
- 23:14Brute-forcing JWT secrets
- 37:28Demo: Cracking the secret
- 38:33Is JWT safe to use?
- 42:06Q&A session
