The Hacker's Guide to JWT Security
summary
Four live demos show concrete failures and fixes: a none algorithm bypass lets an attacker replace a token and become another user because parse-without-verify mistakes libraries expose; HS256 secrets crack offline with 14 seconds with Hashcat on a GPU to recover "gofer" and mint valid tokens; unencrypted internal hops leak Authorization headers via tcpdump packet sniffing; persistent XSS exfiltrates sessionStorage JWTs using XSS via image src exfiltration. Recommendations: require algorithms/keys, use 32-byte+ HMAC keys or 2K/3K RSA, verify signatures and check claims.
AI-written summary · about
chapters (6)
- 0:00Introduction to JWT insecurity
- 6:36Demo one none algorithm
- 17:31Cracking HS256 keys
- 24:43Sniffing unencrypted tokens
- 26:35XSS to steal tokens
- 29:45Summary and best practices
related talks
37mThe Hacker's Guide to JWT Security
48mThe Hacker's Guide to JWT Security
47mThe Hacker's Guide to JWT Security
43mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
59m{JWT}.{Misuse}.&Abuse
54mAre you sure your access tokens are really secure?
37mAttacking and Defending JWT Tokens: The Ultimate Guide