The Hacker's Guide to JWT Security
summary
Shows concrete failures: tokens are only base64 so claims leak, libraries accept a none algorithm bypass if verification uses parse not parseClaimsJws, HS256 secrets crackable offline with hashcat 2.5B H/s (demo secret found as "jcon29"), RSA-vs-HMAC mixups let an attacker swap alg and verify with a public key, HTTP/tcpdump captures tokens and a crafted XSS loads sessionStorage and exfiltrates tokens (token stolen via XSS). Demos build a vulnerable app and successfully hijack accounts.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:164 demos Problems: RFC. algorithms, implementations, applications Web demos powered by Oracle Cloud • Best practices
- 6:43None Algorithm
- 17:16HS256 Password/Key Cracking
- 22:48Only one token needed - No communication with a verification server - All cracking done offline - A victim/a system are unaware of the attack Weak key problem • Complications - Many algorithms Different kinds of keys
- 29:18Packet Sniffing
- 29:58XSS to Steal a Token
