Question

During an API assessment, you capture a JSON Web Token (JWT) used for authentication. Decoding it reveals a header of {"alg":"HS256","typ":"JWT"} and a payload containing {"user":"analyst","role":"user"}. You want to escalate to an administrative role. Which technique should you attempt FIRST to test for a common JWT verification flaw?

Accepted Answer

Modify the payload to "role":"admin", change the header algorithm to "none", and remove the signature to test whether the server validates signatures

Answer

Brute-force the HS256 secret with a full 256-bit keyspace using a GPU cluster before making any request

Answer

Base64-encode a new random signature and append it, expecting the server to accept any well-formed token

Answer

Replay the original unmodified token repeatedly to trigger a session fixation vulnerability