JWT Introduction¶

root-me challenge: JWT - Introduction: To validate the challenge, connect as admin.

Log in as guest, change the first two parts of the JWT token (none and admin), and connect as admin instead of guest.

Techniques¶

• JWT attacks

• JWT attacks runbook

Counter moves¶

JWT Introduction is what this page works through. Server-side validation and least privilege are what these reduce to. Defenders’ notes on this are under the application layer as a target.