RMRenukashree Muraliinquietbytes.hashnode.dev·Jul 18 · 5 min readJWT Attack Lab — Part 8: Algorithm Confusion, and a Bug the Attack Uncovered By AccidentPart 8, the final stage in a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 7 closed a gap in expiry enforcement. This last stag00
RMRenukashree Muraliinquietbytes.hashnode.dev·Jul 18 · 4 min readJWT Attack Lab — Part 7: When exp Isn't Actually Enforced EverywherePart 7 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 6 spoofed a JWKS URL to bypass RS256 verification entirely. This part00
RMRenukashree Muraliinquietbytes.hashnode.dev·Jul 18 · 4 min readJWT Attack Lab — Part 6: Spoofing the JWKS URL an RSA Verifier TrustsPart 6 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 5 exploited kid to point a local file lookup somewhere unintended. Th00
RMRenukashree Muraliinquietbytes.hashnode.dev·Jul 18 · 4 min readJWT Attack Lab — Part 5: Path Traversal Through the kid HeaderPart 5 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 4 cracked a weak HMAC secret offline with hashcat. This part doesn't 00
RMRenukashree Muraliinquietbytes.hashnode.dev·Jul 18 · 4 min readJWT Attack Lab — Part 4: Cracking a Weak HMAC Secret With HashcatPart 4 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 3 fixed the alg: none bypass by explicitly restricting which algorith00
