JWK (JSON Web Key) Header Injection

The JSON Web Signature (JWS) standard allows tokens to include an embedded public key in the jwk header parameter. If the server verifies tokens using this header without checking against a trusted key store or whitelist, an attacker can embed their own public key and sign with their own private key.

If you get stuck, or want more information, see my walkthrough.

Sample Token (Guest)

Inspect the header to examine the embedded jwk object:

eyJhbGciOiJSUzI1NiIsImp3ayI6eyJhbGciOiJSUzI1NiIsImUiOiJBUUFCIiwia3R5IjoiUlNBIiwibiI6InFtd3dvQTFqXy1RQUxZUGp2NEJMcXA0czNjZHlKN0lVX3l5Q1F5N2RmVzJ4bEQtS1ZJRjRwUy0zUTZnMUxRTnNLUW9US080V3RLdXo4NXdkWlRtOTZNa2hoYjhqRWpIcGVfWUZscjF1bF92TVhiS242OUhaTTBIWWQ0N0lLZ2ZXUndOdmx0QnRTLThQQVUtMDVqSGh0X3hCdklfbGpVcTF3SDlTc3BIYmExT0xaMUZxS0QtMWRlODdpOTFkTnZ4WVNLM1p4Y2hEX1Q3bmdKSmMyWHEzWUdfVW9xNUI5MWNnTmxJRHFURElIVm5RSTZjdF91NFNDS1N2ZG11UGxQdUpTbVg2VVUwSkhXNkFROS0zYUVPclhuYWY5d3RzRWtKVHBLbDJsUFpOMDJZUjFBRUV2Wl83YlN2QzBOdmg1X2I3SUlNRWo4M25pLThjV055X0RCakQzdyIsInVzZSI6InNpZyJ9LCJ0eXAiOiJKV1QifQ.eyJhZG1pbiI6ZmFsc2UsInVzZXIiOiJndWVzdCJ9.TPjuzTzOB1JAdgV9HxhRzHHPY8smRXCQySw-W8ZdqNyrCfPzRh5Rbl5KjqpDYvgn-6UCPNxtFIezA2l1eWGc8Wc3MxDYdi9J-x-IcZYdmINTrf_WTP4P-fjDL_bJzjusFdMcZGsDDnw1h8alaGbjHw65sXBe7RUu1sAXhGZ8YpSlZ4wrcxGczbTL__61ElODtig5jJ1PKNe9t0XSnziihJ3h3Qi8oYBbn1RXanaBwmFC_SiDkjD72ClrKXbTJC_dPI_WP0mVrSRhFn45DZW37VDPn6PhDTnuCEOHpmhnUTPG6GWXmMYz0gM7eyiVtRW8F6OEwJPCnnsFMK82n6I3LQ

Submit Token

Back to home

Lab created by Robin Wood - DigiNinja