JWT Key Confusion PoC (CVE-2015-9235)
Written for the Hack the Box challenge – Under Construction
This script performs a Java Web Token Key Confusion Attack (CVE-2015-9235). To perform the attack it is required that the attacker know the public key which the server will use to verify the signature as well as the server being configured to use the HS256 algorithm. Because HS256 is a symmetric-key algorithm (the same key is used to sign and verify the message), we can use the public key to sign our tampered token. Since the web server knows the public key, when it receives the tampered token it will be able to verify it.
Screenshot
Usage
python3 jwt-9235.py [-h] [token_location] [claim_key] [claim_value]
positional arguments:
token_location location of JWT token (must include 'pk' payload)
claim_key payload claim to target
claim_value new claim value
optional arguments:
-h, --help show this help message and exit
If no arguments are provided the application will look for a token file ./token, target the username claim, and replace the claim value with ‘ or 1=1;–
Requirements
pip install hashlib hmac base64 json argparse colorama
