🧪 Labs › Authentication
JSON Web Token Attacks
Severity: High
When a token's signature isn't verified properly, you can rewrite who you are.
What it is
A JWT carries claims (who you are, what you can do) plus a signature that's supposed to prove the server issued it. The security rests entirely on the server verifying that signature correctly.
Common failures: accepting the 'none' algorithm, confusing a public key for an HMAC secret, or using a weak signing secret that can be cracked offline.
Any of these lets an attacker forge a token with elevated claims and be trusted as another user or an admin.
How to approach it
- Decode the token and read its header and claims — they're not encrypted, only encoded.
- Look at how the server verifies: which algorithm, which key, and whether it enforces them.
- Test whether the server will accept a token you altered — a changed claim, a changed algorithm — and reason about why it did.
- If a secret is involved, consider whether it's weak enough to attack offline.
Your task
Forge or alter a token so the application treats you as a different, more privileged user.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Pin the expected algorithm server-side; reject 'none' and algorithm swaps.
- Use strong, random signing secrets or proper asymmetric keys.
- Keep token lifetimes short and verify every claim you rely on.
More Authentication labs
- OAuth & Token Flows — The login dance has several moving parts — and skipping a check in any of them breaks it.