FeedDiscussion
HackTheBox : WayWitch Writeup
Summary The ticket portal generates guest session JWTs client-side, signing them with an HMAC secret (halloween-secret) that's hardcoded directly in the page's JavaScript. Since the server verifies to
exploitnotes.hashnode.dev4 min read
#hackthebox#htb-challenges#jwt#json-web-token#authentication-bypass#hs256#cookie-forgery#client-side-security#javascript-security#broken-authentication#access-control#burp-suite#python-jwt#web-security#cybersecurity#penetration-testing
Responses
No responses yet.