How I Bypassed the JWT task from the XSS RAT CTF

CTF Challenge. The challenge-based contest consists of various security challenges related to web application security, allowing anyone from aspiring hackers to seasoned professionals to take part and learn new things about this trending field. OSINT, Source code, Crypto, API, Reversing, Forensics, Web and WiFi.

Now, We will see how I bypassed the JWT first task from the ctf. before that let me introduce JWT: JSON Web Token is a compact, URL-safe means of representing claims to be transferred between two parties. It is commonly used in web application security, particularly for authentication and authorization purposes. look it is used for authentication and authorization. so let me go and try our ctf.

When I open the task, it only gives us the ctf link, with no hint or other interaction.👇👇

Then I opened it using this link. hackxpert.com/hidden_123/JWT1.php

Now, it’s time to find our jwt token, so first I checked the source code, nothing interesting, then again I tried to scan the directory and maybe hidden URL’s, but nothing. huh.. If you take the xss rat jwt course, maybe from CNWPP or YouTube, I’m 100% sure you’ll get the hint to pass this, so I tried looking at my cookie but nothing here.

let’s play with Burp👹👹, open your burp and intercept any request and response. boom! I got this when I reloaded the page😍😍

Now, look at the HTTP Response Header: before that let me introduce you to the HTTP Response header in short: *An HTTP response header is a component of a network packet sent by a web server containing status codes and information about the server, requested resource, and client. In short, it contains the metadata related to an HTTP request-response transaction between two systems. *So let’s go back and do our work!

So notice on the authorization header from the http response header, looks interesting. It is sent from the server to authorize us. btw it’s a JWT token😍 time to decode it!

Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjYW5WaWV3RmxhZyI6IkZhbHNlIiwiZXhwIjoxNjcyOTE4NjY2fQ.uxIEwI4VWkJhtVQkwezZeFSfvoK50ZvSzr6nlBDcGI4

so let’s go and decode the jwt token. I used jwt.io for this task.

Now, everything is fine. but look at the payload part, think there is any issue.

"canViewFlag": "False" => "canViewFlag": "True"

We must turn this into True. Otherwise we can’t find or get the flag.

Boom! i changed it to True! so let’s go and copy our edited jwt token.

Now, enter your edited jwt. You will find your flag. Because we changed the “viewflag” from false to true. So now we can see our flag.

Cookies: are a staple of the internet they are small pieces of data stored by your web server and sent back to websites browser in various requests. They are used for authentication, tracking website usage, customizing content and preferences, remembering transactions, and more. it’s important for Web Pen-testers and also for web developers.

Authentication vs Authorization:

I Authenticated myself with my username and password or any other security method such as bio-metrics or a PIN code.

I can also Authorized which means that the server will allow me to perform certain actions like changing profile image, uploading something and etc..

Conclusion: don’t forget to check and source code, http req , res and Finally, it is important to use secure coding practices when developing applications to ensure that they are protected against potential threats.