Hacking and Securing JSON Web Tokens (JWT)

Set up the lab for hacking and securing JWTs by configuring VirtualBox with Kali Linux and the secure store JWT VM. Use Postman and OpenSSL to practice with JWTs.

Explore the json web token (jwt) standard, a compact, self-contained format defined in rfc 7519, used to securely transfer information and verify authorization between parties.

Explore the JWT structure, including header, payload, and signature, three parts separated by two dots, and see how base64 URL encoding lets you decode the header and payload.

Explore the differences between base64 and base64url encoding, including how plus and slash become minus and underscore, and why padding is omitted for network-safe data in tokens.

Explain how the header and payload encode, and how the signature is produced using cryptographic algorithms like HS 256 and RS 256 in json web tokens.

Explains how a client obtains a JWT from an authorization server after authenticating with credentials, and how resource servers verify the token’s integrity, guarding access against tampered tokens.

Watch a JWT demo using Postman to log in, obtain a bearer token, and request credit card data from a secure store, showing tampering causes signature verification to fail.

Understand JSON web tokens by examining header, payload, and signature, where header and payload are base64-encoded, not encrypted, so avoid sensitive information and use the signature to validate the payload.

Explore JWT headers and learn how the token type and the HS256 algorithm provide metadata for the resource server to validate the signature.

The jwt payload stores user identification data, including user id and username, plus is admin, with issued-at and expiry timestamps and issuer details, controlling access after signature verification.

Explore how the JWT signature combines header, payload, and a key with an algorithm to prevent tampering, focusing on HS 256 and RS 256.

Learn how HS256 uses sha-256 hmac to sign json web tokens by combining base64 header and payload with a shared secret. Recognize risks from key distribution, server compromise, and tampering.

Watch a HS 256 demo that creates and validates a json web token using a shared secret, showing login, token payload, and signature verification in a lab API workflow.

Explain how RS256 signs the JWT header and payload with RSA private key and SHA-256 hashing to form a digital signature, verified by public keys on resource servers.

Demonstrate RS 256 based json web tokens by signing with a private key and verifying with a public key, using postman to login to the v3 endpoint.

Demonstrate the none algorithm in json web tokens, showing how the absence of a signature enables tampering of the header and payload and highlighting signature-stripping risks.

Learn to generate HS256 signatures using the command line, using OpenSSL to create public and private key pairs, and reproduce a sample JWT token's signature.

Generate a 2048-bit RSA private key and its public key with OpenSSL, saving them in the rsa keys directory, and learn how RSA 256 signatures use the private key.

Manually create an RS256 signature for a JSON Web Token using the command line, OpenSSL, and base64url encoding of the JWT header and payload with sha-256.

Explore attacks on insecure json web tokens implementations, including nun algorithm, signature stripping, cracking weak shared secrets, and substitution attacks, with practical demos and a lab setup.

Demonstrates abusing the none algorithm in jwt tokens by tampering the payload to impersonate admin and reveal the admin's credit card number, illustrating how missing signature checks enable token forgery.

Demonstrate abusing the none algorithm with burpsuite, using the repeater tool to modify tokens and access admin data, including credit card information.

We demonstrate a signature stripping attack on JSON web tokens, showing how tampering header and payload to none can access the admin credit card number.

Demonstrates cracking weak HS256 shared secrets using a JWT cracker to forge valid tokens and signatures, highlighting the security risks of HS256 and the importance of strong shared keys.

Demonstrate a substitution attack on json web tokens by altering header and payload to admin, and explain how public-key verification and algorithm choices affect token validity.

defend jwt tokens by whitelisting algorithms, avoiding none type, using separate decoding functions for rs256 and hs256 to prevent signature stripping and substitution attacks, and using strong shared secrets.

Leave a review if you enjoyed this course and share it with your friends and colleagues. Thank you once again for choosing this course.