Hey, guys, welcome back to another episode on How to Hack.
So today we will be discussing about JWT tokens, which are JSON Web tokens, and it is primarily used
for authentication.
And there are certain common pitfalls that we have to watch out for.
So over here, we can have an introduction to JSON tokens, which allow clients to indicate its identification,
its further exchanges after authentication.
And of course, here we have the second tab as well on the structure of JWT token.
So JWT token is basically for All Right and KODET and consists of three main parts, which is Hater's
claims or otherwise called Pelote as well as signature.
So in this case, we have, for example, over here, JWT hater and we have ALJ.
So LG stands for the algorithm that we'll be using for and we have IP, which is of course, Jason,
Web tokens, and we have to pay.
So people are basically information and we're putting in do so over here.
We have, for example, the XP.
We have a user name we have to scope.
Do you Tomatis, for example, certain specific roles that the user has on the website.
All right.
And many, many other different details and data that we can input in.
And of course, we have the encryption key and as well as D generated JWT token.
So go in and clicked on it.
And we have three key parts.
So firstly we have the data.
All right.
And this is followed by a single full stop sign followed by Paillot and then finally on the signature.
And of course, we have the full JWT token over here, as you can see.
So, of course, you can easily change the encryption key to say one, two, three, four, five, six.
Go ahead and click on generate JWT token and it will produce the signature.
OK, so very quickly, we understand about the structure of the JWT token and you can easily make amendments,
changes to both the header de payload as well as the encryption key.
All right.
So all those can easily be changed to structure and content of value if it can be changed.
And here we have the basic sequence, which is pretty straightforward.
So you have to browser coming in.
So it could be Google Chrome, Firefox Safari, any browser from any operating system, which is then
later connected to the Web server.
So first step is, of course, as the user posts data into the website using the login username as well
as password, and that will create a JWT with a secret exactly as what you saw earlier.
All right.
From the results.
And this would return to JWT into the browser, which will be safe into your storage.
And after that.
All right.
Sensage JWT information into the server and the server will check and verify the signature verified
information and data and a response rate to decline.
So pretty straightforward.
Six steps for us to actually go through the entire process.
And of course, everything is done in a fraction of a second and we'll learn about how to change those
seven values.
So going to item number four.
OK, so we have JWT signing.
All right.
So it says over here each JWT token should at least be signed before sending it to a client.
All right.
So that's very important.
So first of all, we have to verify signature before performing any form of actions or else we can do
a lot of things.
So over here, again, we are going into the normal mode.
What is normal considered as part of the activity in site, this site.
So here we have.
Welcome back guests.
All right.
So and all assignment is to change the token you receive and become an Etman user by changing the token
and once your admin reset votes.
OK, so we are guests right now and we have vote for your favorite Etman lost password.
Get it for free, vote for your favorite photo comment.
So let's say we click onto the first tap and it says that at a guess you're not allowed to vote.
Please log in first so we can go ahead and click onto the drop down menu.
Now we can look at all the uses that we can authenticate as so I can click on Tom.
So once I click on Tom, we can see the number of votes.
OK, so we got one each.
And if I click onto the first one, OK, and we can go in on the refresh button, I can click on the
second one.
And of course, based on the results, it seems like Tom has already voted.
So if I click on Jerry, OK, if I click on Jerry again, we're seeing one vote each so I can go ahead
and click over here.
For example, I can a vote now and we can scroll back down again and this becomes three votes.
OK, so we can see all this different data.
And of course, we're seeing that Jerry could vote multiple times.
And of course, we also have Severstal so we can go ahead and click on.
So get it for free.
And again, we can look at all these different details and data or what's going on in the site.
So what we're going to do next is actually on the right site.
So there is this part core.
We set votes so we can reset all the counters in all of the tabs to go in and click on that.
And it gives us a problem.
It says only and at the end user can reset to votes.
So what we're going to do now is to go to the top right corner of your browser.
And of course, in this case, we're on.
Fox and we can click on our web developer and we can click under the Star, which inspector on a star
inspector, we can look at the session.
OK, so over here we have cookies, information and we have session.
All right.
So if I click onto, say, a change to Tom, all right, this would change, for example, the values
of the access token.
And if I change it to guest, that would remove the access token, as you can see from here.
OK, so very, very quickly, we could understand about how the access token is being issued by the
Web application system to the user, all to the browser.
And what we can do next is we can click on Tom, for example, and we can go under the network tab.
So we're collecting data now and delete it all.
OK, so I'm going to click under reset votes, click on that and we have a voting over here, so go
ahead and click on it and we show us more information about it.
So we have the response and he says lesson completed, false and it's his feedback.
Only an admin user can reset to votes.
OK, so we see those details and data over there.
OK, so we can look at all these different details that's been sent into the site and so on so we can
go in.
Right, click edit.
And we said, OK, so over here we can look at the details.
So we have the access, token information.
We have all this different data points that we can look at.
So go ahead and copy the following, which is the access token copy to information here.
And we can go into this website, for example, base sixty four format, OK, so we can actually decode
it.
Click on to decode and we can actually paste information here.
And first of all, we will definitely need to be able to paste the data right here.
OK, so I can go ahead and copy these details.
All right, paste it here, click under Decode and we get the following results, which is, of course,
this is the header information of JWT.
So here we have an algorithm highchairs five one two.
OK, and if course if I go ahead and paste the second item over here, all we can copy everything in
and we can paste it all in copy and we can paste it all in.
All right.
So again, we are decoding all those information that we're getting from the cookies.
So here we have algorithm.
Let me zoom in a little more so it's easier for you to see.
So we have algorithm pages five one two.
We have it with Etman is false and we have user Tom, OK, and then followed by the rest of it, which
is Steve's signature.
So in this case, we understand a structure of what is being safe into Web application browser.
So we are understanding what's being sent from the Web application server to the browser and how it
is being sent over into the Web application system.
And of course, in this case, we have Etman as false.
OK, so we need to change this.
And at the same time, OK, there are certain things that we need to do as well.
And that is, of course, trying to change the algorithm.
OK, so there is a way for us to actually remove the algorithm entirely, which help us remove also
the signature.
OK, so there will be another way for us to actually set those details and data.
All right.
So first of all, OK, we can go back over here and we can set the algorithm to null, OK?
And of course, we can see on the second step we have it so I can copy the right click copy, go back
and paste the information here.
And we have been true and user Tom.
So what I will do now is to actually encode it.
So let's encode the first segment, which is algorithms now.
So go ahead and go back to basics for D Coorg.
Click under and code, OK, and we can paste over here and click onto encode and this will produce the
results of the base64 format so we can copy this.
Go back to your favorite editor and we can paste information, have put a single full stop.
So this is to demarcate.
All right.
Or to at a delimiter into the payload.
All right.
So here we have for example, over here we have the algorithm is null and we got to copy this information
here.
Copy it.
All right.
Pace it into the base.
Sixty four and click under encode and we got the details and we can copy the information from here.
So you have to ignore the last two equal sign on it.
All right.
Go back to your favorite editor page, the information.
So we got all the details right here.
We can copy the details, go back to Web, go.
All right.
We can pass the collection of data and do a right click, edit and resend, which we are really doing
now.
OK, so we can delete away all of those inside the access token tab under cookies.
All right.
So once we do all of it, all we got to do is place the information that we have now crafted to be sent
over into the site.
So go and do a right click.
It followed by full stop.
OK, so remember to put a full stop, we need at least two full stops.
All right, 140 hater and one for the payload.
So once you have all these details running, you can go ahead and click under send.
OK, so once it is sent, you can go ahead and click onto the details.
All right.
So we can look at the response and it says over here, congratulations.
You have successfully completed the assignment.
So we have made a reset into database system to reset all of the vote counts.
So you do a refresher again.
We can do a reset immediately of all of the vote counts.
So, once again, I hope you've learned something valuable in today's tutorial.
And if you like what, you just watch them to, like, share and subscribe to a channel so that you
can be kept abreast of the latest cyber security target.
Thank you so much once again for watching.