> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-jwt-labs/lab-4.md).

# lab-4

## JWT Authentication Bypass via JWK Header Injection

**Difficulty:** Practitioner

### Lab Description

This lab uses a JWT-based mechanism for handling sessions. The server supports the `jwk` parameter in the JWT header, which is sometimes used to embed the correct verification key directly in the token. However, the server fails to check whether the provided key came from a trusted source.

**Objective:** Modify and sign a JWT that gives you access to the admin panel at `/admin`, then delete the user `carlos`.

**Credentials:** `wiener:peter`

### Root Cause

If the server blindly trusts a user-controllable `jwk` parameter in the JWT header, it uses the attacker-supplied public key to verify the JWT signature. Because the attacker controls both the key and the signing process, they can generate a JWT signed with their own private key, embed the corresponding public key in the header, and the server will verify and accept it — leading to account takeover and session hijacking.

Vulnerable flow:

```
Receive JWT
      │
      ▼
Read jwk header
      │
      ▼
Extract Public Key
      │
      ▼
Verify Signature
      │
      ▼
Trust payload
```

### Exploitation

1. Start the login flow and capture all requests in Burp Suite.
2. Find `GET /my-account?id=wiener` and send it to Repeater.
3. Go to the **JWT Editor** tab in Burp and generate a new RSA key (the target JWT uses an asymmetric algorithm).
4. In Repeater, update `"sub"` to `"administrator"` in the JWT payload and change the URL to `GET /admin`.
5. In the **JSON Web Token** tab, go to **Attack → Embedded JWK**, select the newly created RSA key and set algorithm to `RS256`.
6. Send the request and open the response in the browser.
7. Click **Delete carlos** in the browser and capture the resulting request.
8. Find `GET /admin/delete?username=carlos`, update `"sub"` to `"administrator"`, and repeat step 5.
9. Send the request — the user `carlos` is deleted.

### Lesson Learned

Never trust user-controllable `jwk` header parameters for public key verification. The verification key must always come from a trusted, server-side source — not from anything supplied by the client in the token itself.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-jwt-labs/lab-4.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.