[Music] what's going on everyone in this video i
want to talk about attacking json web tokens so if you don't know what json
web tokens are they're typically used for authentication or authorization
purposes in things like web applications mobile apps apis you know things like
that um so what do json web tokens look like if
you don't know here's a quick overview they're made up of three parts a header
a payload and a signature which is all base64
and split up using full stops
so when you decode that base64
this is what a json web token looks like
your header here has an algorithm typically
your payload has any data that the developers want to put in there and the
signature is
the signing entity of the json web token which essentially makes sure that
developers can create json web tokens but attackers can't just edit json web
tokens or create their own so this is usually signed using a key or
a certificate and that's denominated using this
algorithm tag so
how do you attack json web tokens well there's a few ways
which i explained in my blog and i'm going to explain now um
the first ways aren't really attacks are just things to look out for so sensitive
data and not expiring tokens um so if you're seeing this payload data
you can see that developers might have put some sensitive data like a user's
password it might be a password hash that you can crack something sensitive
like that so if you can gain access to another user's json web token whether
you social engineer that or take it from a web proxy or something like that and
then you decode it if you see this sensitive data you might be able to log
in as that user so best practice for developers is to get
rid of any sense of data that might be in json web tokens because someone
might see it
the next thing is there's no expiry within the payload you can see that
there's a name there's an issue time there's no expiry so this might mean
that the json web token is valid indefinitely so if you can gain access
to a user's token you might be able to use that forever so what you need is
not exploit known vulnerabilities what you need is an exp
for expiry and then just an expiry time just make it valid
that's what you need anyway let's get into some actual
attacks so there's a website called
jasonwebtokenlab herokuapp.com it's in the description check it out and this is
basically i kind of captured the flag for jason webb tokens
it doesn't go through every single attack possible but it goes through a
lot of them and you get the kind of general idea so first thing to do is go
to users go all the way to the bottom and create yourself a new user using
this new user button here i've already done it so i'm not going to do it again
then go to challenges here's your available labs the first challenge we're
going to do is the none algorithm so
what i recommend you need to do these labs is a cookie editor so i'm using
cookie editor for firefox you guys the same thing for chrome as well if you're
doing it in that and the first thing we need to do is register a user and gain
access to the admin user so if we log in as my user
you can now see that the current user is turv which is what i've just logged in
as the purpose of this is to gain access to admin user so if i just take my token
here which is in the challenge
cookie this might be a cookie in a web app it could be a bearer token in http
headers it could be in a few places but as i say
it's just it's going to cook you this time
so if i take that cookie put it into the website we were just looking at
you can see this base64 decoded data it's using the rs256 algorithm which is
a certificate based which is why it's asking for a certificate
and you can see the payload data is name equals turv which is me and that's why
i'm signed in as user turf so what we need to do
is change this name to admin rather than turf and we can't just
simply type in admin here take this cookie uh take this token and put it
into the cooking work because the signature
isn't correct i mean i i don't have the certificate to sign this the developers
do so we need an attack that will allow us to gain access to the admin user and
the way we can do this is or at least in this example is use the nun algorithm so
essentially what happens here is in the algorithm
none is entered
admin is entered here and then we remove the signature from
that payload so it's not really that easy to do it in this website so there's
a great tool called json web token tool
and you can see here under the xta mdx flag all of the different attacks that
can be done with it so i've already got this set up so python3 jsonwebtoken.pi
just paste in our json web token there and then the i flag means that we want
to change this location web token the pc flag
is name which is that
name payload data here and then we want to change the terv to admin so
we go pv flag admin so that will change that term to admin the x flag
denominates the attack which a is null from the
documentation a equals null uh sorry none attack so if i just go ahead and
enter that you'll see various tokens being given to you and that's
because the algorithm can be changed to none it can change the number of capital
and a few others so camelcase example so just take one of these
you'll see that there's only
two base64 encoded strings here one's there then a full stop and one's there
and then another full stop so the signature's actually omitted here and
that's what you need to do for a non-algorithm because obviously none
means no algorithm so there's no signing if that makes sense so if you then go
copy that and then put that into your token here
we'll have gone from user turf to when we refresh user admin
so that's a none attack the none attack means that signatures aren't being used
it's it's the none algorithm so if we then move on to the next
challenge which i'm not going to expose key this time i'm going to do signature
not checks because it's kind of the the next logical step after a none attack
if i go ahead and just remove my cookies here
because it's a similar attack to the last one
log into my user again my user is turv if i take that cookie
pop it back into the json web token website so we can look at it it's uh
it's a similar to the last one so all
this attack is going to do when we use the json web token tool
which is this one if i
pop the json web token in again this time everything's exactly the same
apart from the exploit is now n instead of a and all this does is it removes the
signature but it doesn't change the none algorithm
sorry the algorithm to none it keeps it as the
rs256 as you can see here but it's changed the names admin and it's omitted
the signature so if we put that into here again
and refresh or admin so the two exports i've shown you there is
the algorithm being none meaning it's not checking a signature and the second
one is it is using a signature but it's not actually verifying that that
signature is valid
so those are some very easy attacks the next one is an exposed key or it's
sometimes called a key confusion attack so if you can gain access to the public
key being used
you might be able to change the algorithm from a certificate based
algorithm to a key based algorithm and use the public key as a key
and i'll show you what i mean by that so if we log in as my user again
i'm logged in as turf and it's using the algorithm rs256
so if i take that cookie and just verify that
yep it's using the rs250.6 algorithm with the name turv great so
now this this signature is being checked so i can't just change it and do what i
did last time what i have to do now is try and trick it so rather than using
the rs256 algorithm which is a certificate we're going to change that
to a hs256 which uses a key and for that key
we're going to use the public certificate
of the rs 256 key signing algorithm
it's a bit confusing but bear with me here so using js using this public key
here which we've got from the website you can also use openssl to
connect to the website and gain the public key back that way
which i'm not going to show you here it gets a bit complex but if you take this
public key pop it into a word uh a text file which i've already done
and i've called it public key you can use json web token tool i'm just going
to go back and grab that json web token
pop it into here use the i to tamper with the json web
token we're doing the same thing with the name and admin the export is k for
the key confusion attack and the key we're using is public key which is
that key here
so again just to reiterate what i'm doing here is changing the algorithm for
r from rs 256 which is a certificate to hs256 which is a key based signing
algorithm and when using the public key as the key
so we're not using the the private key at all here where we're tricking the
algorithms to use the public key rather than the private key if we enter that
take the json web token
that it provided us and pop that
into here save it
and we're now an admin using key confusion so again what we've done there
is change the algorithm from rs256 to hs256 which just takes a single pass key
and we've used the public key as that pass key to confuse the json web token
implementation to think it's taking in the private key
when it's actually just using the public key
a bit confusing but that is how it works so the next thing is weak signature and
what they want you to do here is crack the
the key that signs the certificate essentially sorry the key that signs the
json web token they've provided a word list here
obviously a real website wouldn't do that you need your own word list but you
can take that word list
and uh use it in a minute so let's just log in again
i'm logged in as turv we'll take that key json web token we'll pop that into
the json web token so we can see it it's using hs256 named turf okay great so
let's then put that into our json web token tool again this time we're going
to use the c flag for cracking the d flag and the word list that i just
showed you and what it's going to do is it's going to try and crack that json
web token to try and basically find the signing key
and as you can see i love you out of that word list was the
correct key so what we now need to do is sign a json web token
so we can become an admin using the i love
you key which i should have back here somewhere so using the same json web
token and then the the iepc flag and pv flags that we've used previously we're
now going to use the s flag it's actually hs 256
which is the algorithm being used and a password is i love you
take the output json web token there
which has been signed using i love you and we've obviously changed the data
if we then go ahead and put that into the challenge cookie
we're now an admin so we've just brute forced the key and
that's why i said earlier that i prefer certificate based signing than this
simple key based signing because you'd firstly have to get the certificate
before you do any brute forcing much more secure implementation providing
certificates aren't publicly available for some reason okay so the last one
here is vulnerable kid so i'll show you this first
logging in you'll see that my current user is turv
if i go ahead and show you the see the json web token here you'll see that
we've got a kid value in the header and the name is turf again so what the kid
value does is it specifies a file within the web
backend structure the web root structure to
verify this key against so when you try and use this json web token
it will look at the rsa private key and make sure that it's a valid signature
using this key so this kid value can be vulnerable to sql injection it can be
vulnerable to
signing against another file if you can see it in the web route so for example
they give you this random page here and this is the web root file that they
want you to exploit this with so if you go ahead and take that
and we'll use json web token tool once more
you can do json web token tool sorry let me just take the
challenge token again pop your json web token in there
we're going to use the ipc and pv flags like we have been using but this time
we're going to be doing the hc flag which is changing the header value kid
which we've already seen is this rsa private value
so it's going to change the kid value to app views authentication random html dot
erb which was that random page that we've got here
so what's going to happen here is the token is going to change the kid value
to this path
and it's going to validate the signature against whatever's in this
file which we can see is actually find me in that
it's going to validate against this string here
so what we've done is we've changed the kid file we're signing it with pages 256
again which is because that's what it's signed with and the password is going to
be find me in app views authentication random blah blah because that is what is
inside this kid file so we can now take this
go challenge pop the json web token in there save it
and we are now an admin and that's how you exploit the kid
vulnerability so just to reiterate that is changing the kid value to any file
within the web root structure that you can access and see the contents of so
this random page would be that file you can access it you can see this is the
contents and you can see this is what the file actually is so we've changed
that kid value to just this because that's what this random file relates to
in the web route and then the contents of this is the key so you can do that
with any file in the web route and that's how you exploit this issue and as
i said this can sometimes also be sql injectable
so that's another part to look down so that's all of the challenges as i say
there are more json web token attacks these are the
main ones um but yeah that's the json web token attacking video uh check out
my blog because i've got more stuff
on there than what i've shown in here
and i hope you've learned something thanks for watching
[Music]