Web Application Hacking (Hands-On)

JWT Attacks — Concept + Live Lab

Forge JSON Web Tokens via alg:none and weak signing secrets.

Advanced · 18 min · Hands-on lab

A JWT is three base64url parts joined by dots: header.payload.signature. The header names the algorithm, the payload holds claims (like your role), and the signature is meant to prove the token wasn't tampered with. Attacks target weaknesses in how the server verifies that signature.

eyJhbGciOiJIUzI1NiJ9 . eyJyb2xlIjoidXNlciJ9 . <signature>
     header (alg)              payload (claims)         signature

Attack 1 — alg:none

Some libraries honour a header of alg:none, meaning 'no signature'. Change the header to none, edit the payload to role:admin, drop the signature — and a vulnerable server accepts it.

Attack 2 — weak HMAC secret

HS256 signs with a shared secret. If that secret is a weak/guessable word, you can brute-force it offline (e.g. hashcat mode 16500), then legitimately re-sign a forged admin token.

Take the quiz and try the live lab →