- 1Create a free account, then click "Start Lab"You'll get your own private machine with an IP address
- 2Explore the targetOpen the IP in your browser and look for vulnerabilities
- 3Find and submit flagsFlags are secret text strings hidden in the system - paste them below to score
- ~1-2 min setup
- Private instance
- 30 min per session. Restart it for free, as often as you like.
JSON Web Tokens (JWTs) are the backbone of authentication in modern web applications, and JWT hacking has become a critical area of security testing. JWTs allow servers to issue self-contained tokens that encode user identity and permissions, which the client stores and sends with each request - typically in cookies. However, improper JWT implementation creates serious security vulnerabilities that attackers can exploit for privilege escalation and authentication bypass.
Understanding JWT Structure
A JWT consists of three Base64-encoded parts separated by dots: the header, payload, and signature. The header specifies the signing algorithm (e.g., HS256, RS256). The payload contains claims - key-value pairs that typically include user identity, roles, and expiration time. The signature verifies that the token has not been tampered with. Understanding this structure is the first step in JWT hacking, as each component presents potential attack surfaces.
Common JWT Vulnerabilities
Several well-known vulnerabilities affect JWT implementations. The algorithm confusion attack exploits servers that accept the "none" algorithm, allowing attackers to forge unsigned tokens. The RS256-to-HS256 switch tricks servers into using a public key as an HMAC secret. Weak signing secrets can be cracked offline using tools like hashcat or john. Additionally, servers that fail to validate claims like expiration time, issuer, or audience accept tokens that should be rejected. Cookie-based JWT storage adds further risks if cookies lack proper security flags.
JWT Security Best Practices
Secure JWT implementation requires using strong signing secrets (at least 256 bits of entropy), validating all claims on every request, explicitly specifying allowed algorithms to prevent algorithm confusion attacks, setting appropriate token expiration times, and implementing proper token revocation mechanisms. For cookie-based JWT storage, developers must set the HttpOnly, Secure, and SameSite flags to prevent client-side access and cross-site attacks.
What You Will Learn
- How JWT structure works including headers, payloads, and signatures
- Common JWT vulnerabilities including algorithm confusion and weak secrets
- Techniques for decoding, analyzing, and manipulating JWT tokens
- Cookie-based authentication security and privilege escalation
- Best practices for secure JWT implementation
