The Hacker's Guide to JWT Security
summary
Walkthrough of four live demos shows concrete failures and fixes: a none algorithm bypass accepted because code uses parse not verify; an HMAC key recovered with hashcat on 6× RTX 3090 in 16s demonstrating weak shared secrets; a packet sniffing of internal LB that exposes valid tokens when backend links are unencrypted; and an XSS steals sessionStorage token proving JavaScript-accessible JWTs are fragile. Recommendations include explicit algorithm/key checks, use of jwt.io and maintained libraries, hardened cookies over sessionStorage, and server-side revocation/state for logout.
AI-written summary · about
chapters (19)
- 0:00Start
- 1:17Form3
- 2:59RFC 7519, JSON Web Token
- 6:14HTTP Request with JSON Web Token
- 7:08Demos
- 13:22Another Library with None Problem
- 15:12Go JWT Libraries - None Problem
- 16:36Demo #1, None Algorithm, Problems
- 18:08Library API Problem
- 18:32Implementing Verification - Best Practices
- 21:24HMAC-SHA signed with RSA public key
- 22:20Why to Require Algorithm and Key?
- 27:13hashcat
- 27:31Demo #2, Problems
- 28:18JWT, Algorithms
- 37:50XSS Attack Vector
- 38:36Problems and Solutions
- 39:53OWASP Token Sidejacking Solution
- 40:26JWT Security
related talks
31mThe Hacker's Guide to JWT Security
37mThe Hacker's Guide to JWT Security
48mThe Hacker's Guide to JWT Security
47mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
35mAttacks on JSON Web Tokens: A Comprehensive Analysis
43mDo You Really Know JWT?
59m{JWT}.{Misuse}.&Abuse