JWT Algorithm Confusion (RS256 → HS256)

Asymmetric algorithms like RS256 sign tokens with a private key and verify them with a public key, whereas symmetric algorithms like HS256 use a single shared secret for both signing and verification. If an application exposes its RSA public key and fails to enforce the expected algorithm, an attacker can switch alg to HS256 and sign a forged token using the server's public key as the HMAC secret.

In real-world targets, servers rarely hand you a ready-made PEM file—instead, they expose the raw modulus (n) and exponent (e) via /.well-known/jwks.json. For extra practice, try reconstructing this PKIX PEM file from the JWKS endpoint and verify that your output matches the reference key below byte-for-byte (including the trailing newline).

Server Public Key (PEM)

Available directly or via /Alg_Confusion/public.pem:

Sample Token (Guest - RS256)

eyJhbGciOiJSUzI1NiIsImtpZCI6ImF1dGhsYWItamt1LWtleS0xIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6ZmFsc2UsInVzZXIiOiJndWVzdCJ9.CqJdMKQrrRdm_GuNeMXc0SaRYlLvLT-qym--xQKL3jNBqMTfCpFO9ZqkeUo2EiYbcFuGpgGIKDbHZFtr5SdoW5jEtb_8PyfOblq37AomafCg8pU37TsdrUxyq_MfmkY-Hp8jtVYbNUfWBlKcfVNtpeyrgBs98SYxsnLRM39G5_nIFjwwa_YMmrGLDU5j6esc3B-Fuh-RvJoLw4QWHdUefnYpTQGeSpCbQvVAleEXTeoHydj6RIxndTPA_Ym7xQJYtos_OSg0PXGQWC9OwcW8haTq3Kw8baKZ8UlXqREb3VR52j6mbhxSz53qTu_GVKSAymsI9ibi5cBaGby6--otyA

Submit Token

Back to home

Lab created by Robin Wood - DigiNinja