个人笔记踩过的坑我都写了进去简单记录我的靶场复现今天复现了Portswigger练兵场之JWT以下都是通过我自己琢磨、查阅资料和朋友指导写的复现笔记小白入门如果在博客中有什么错误或有什么专业用语不当值得改进的地方还请各位大佬不吝赐教。第一关提示使用提示所给账户登录在bphttp历史找到login包发送到repeater解码 JWT网站JWT Debugger发送在响应界面发现session值解码session值发现用户信息将用户改为管理员获得新的session值然后将新session值粘贴到请求包内修改/login为/admin访问admin页面将username改为管理员然后发送看到管理员界面找到删除用户将carlos的href粘贴到post请求包替换/admin替换后发送响应302点击跟随重定向200响应通关如果没有显示302的话直接再次构造新的session值再来一遍第二关第二关和第一关类似编只是第一关session解码为rs256第二关为none 然后在session上加个.发送即可通关第三关提示第三关无法使用相同方法过关找到登录get包发送到重放器复制session弱密码爆破利用hashcat爆破构造语句hashcat -a 0 -m 16500 eyJraWQiOiIzMzIwMmY4ZS0yZmU4LTQ4YmUtYmExNi0yMmNkNWEzODZiMjUiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0NTMxMDkxNywic3ViIjoid2llbmVyIn0.GKWOQmCpuxhYB7GcqEAnrrJQ4y8Z9n1KB55_qxBNvng ./rockyou.txt爆破出密钥为secret1其实实验提示中已经给出了密钥使用JWT 编辑器编辑密钥将用户名改为管理员 VERIFY SIGNATURE下面粘贴密钥将session复制到post包下修改/login为/admin记得删除post包最下面的csrfcwRCLLzUZ4EA21JImdTz9EwFASNABBPmusernamewienerpasswordpeter发送找到删除herf复制到post包下替换/admin发送跟随重定向通关第四关提示bp找到登录get包发送重放器在bp中打开jwt Editornew一个RSA key回到get包修改sub为管理员攻击攻击后将/admin改为/admin/delete?usernamecarlos发送后跟随重定向通关第五关提示登录后找到登录的get包发送重放器在bp中打开jwt Editornew一个RSA key在靶场中打开Go to exploit server修改body为外部为 { keys: [ ] } 内部为在bp中打开jwt Editor 右键密钥选择copy publi key cas jwk 然后粘贴到内部 { keys: [ { kty: RSA, e: AQAB, kid: d31d0e9c-0518-4676-90cf-35eef013e65e, n: uWCojm1w8ibE82Ds6prPPWPiEE7YH1VJ5rfCoZzD_hrxI3hjYEuGzvtIZuJjB5OLvpmY4584zlKf1m4GGnBJLPXr6fAYoNjMfPnSx10uKv7fZxiEwwq1sGn2Sf3p7RVpExKaJzyDgtzEz3lMtefRU3bjIrQ5rrrQIIoGplfB4D6TuUA3t4pkDi75HeX7sarM2vPLY2A4el09pR_MyBSI4WmpC__F3cnfAgPZpFbi482pviy_6zMbbRWw_-DZxv1RmphuQBQ5fiYvJZ2UJ0WLvGRHyuaBtVgPQpd__Z664Ep9flrnARCl1pQ8S5REGG21r23YEGh8yVjIT3J54PBzow } ] }然后回到靶场记得保存点击store替换jwt的kid参数为刚才的jwk的kid参数在标头中添加url url为Go to exploit server中的urljku:https://exploit-0aed0054039a358c80d6931101380016.exploit-server.net/exploit点击sign 然后发送找到删除herf修改/admin发送跟随重定向通关第六关登录靶场将jwt放到jwt.io中修改kid为../../../../../../../dev/null密钥为AA 记得勾选下面的对勾将生成的jwt粘贴到get包session中修改为/admin发送找到删除目标用户的herf将/admin改为目标herf发送跟随重定向通关第七关提示进入靶场网址拼接/jwks.json查看公钥{keys:[{kty:RSA,e:AQAB,use:sig,kid:6bb78fd7-06de-4ab3-9ece-2dedceb58c6d,alg:RS256,n:-R9MTOpggAY6Q2N_7UWnlxMMGTuaXtIaOTGPDBAii45ztIB6KAgH8arVHzg1J5Ru-nR4bcszADU9qT_UdZGMSdu5S6HNBFKwnwv6U9wp7ZTuaCmttJ3bJuiCyuNJJykUefmaE6qjpT3jekHgBH1rT7y0-QpBQxgBd0yqkMqfDCj5gAUAh5j9XDHXuMqhquhHnIU8g-5ZQ0-PsobcAXfJVQCYnC-TwfMNpqsM2-7OhdgG8iuxAGG0atJmswzJmEhnJSmInbLQS6ufCB2ZyjrN3g7nrCx1yhttIVTKFt6NFwhPA_yQdv22vBee_tmSQgMn5GStXHl3IlVxo4HGAkccgQ}]}在jwt Editor里new一个RSA key将公钥放入key中生成然后右键刚生成的key选择copy public as pem将复制的内容base64编码然后在jwt.io中构造记得不要在bp中编码多选几个网站编码bp编码不完全推荐Base64 在线编码解码 | Base64 加密解密 - Base64.us将alg改为hs256sub改为管理员框内粘贴刚才base64编码的key记住勾选下面的选项生成的jwt粘贴到session中发送找到删除herf替换/admin发送后重定向通关第八关登录两次获取两个登录get包有两个session第二次登录 eyJraWQiOiJlZTI3MmEzNC0zY2MwLTQ1MDQtYTNiZC0zZWUyYzg1YWNlYzEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0NTMyMzgyNywic3ViIjoid2llbmVyIn0.fyjZG4GZst5-z6vqETs3gW4MZ7jHexfVqly5qypWsFhq0GKL4G-0tf6PkJgAD86f78NMyBhDm1JPpydmecwDoY0O4HLRyHDmrOjKeKr6tTFqN6SBu84YO7t10oKRd2UBIoVdA9gQePAgslM0AEdfpyYEf6ZN_Waut9jC6GLjCQJ3rucy6OexeT-Qkj65Dbcjvd2achWtlfiVP0Dsl1H_7VQogfNk-79l8URdl8gYFarnaBNhTyqCVkYH0yangrKyZlBUks90S3oIDGLaxxezwtaIesGQkdnIL-pWq0zDAJCJ-XSvCZ094pnXL2s5g6FxgegI0xlWA7V6ne6VhjlM-g 第一次登录 eyJraWQiOiJlZTI3MmEzNC0zY2MwLTQ1MDQtYTNiZC0zZWUyYzg1YWNlYzEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0NTMyMzgxOSwic3ViIjoid2llbmVyIn0.djC9i0QoMSPEF8-SXVP3bZeSV9KwH4pIVpIPIOaHxx21ZWxVc7TRnt55S7KQtXOrWvG5MWreTa2s5G_V52IYfuXAid751sGeKbNt4FDJcmnfWQTLGjBLJaWxtK8xBJrG5_R8Gw-TAsMZ9FsEITucjTg7BcdyYyY3xbHAbw_Q-Xfuew9ChGf8ym2hH8Rn02sbnKy5wONeS6cj5VASwRACuWP55axOEtNRg9zec9KVOBuXB0aSkkpsj2XuLaqKeBDp7ixmH2MvtWIDBsKWhmqLh9N1Sou5m_MA4POYOWX_1BmmKwl86N4BgQpiZSMJV7837I43NBtfYJc6_u5Jy9fxRA利用两个session暴力破解服务器公钥写一个脚本每次做都要修改token1和token2 import subprocess def run_sig2n(token1, token2): command [ docker, run, --rm, -it, portswigger/sig2n, token1, token2 ] result subprocess.run(command, capture_outputTrue, textTrue) return result.stdout if __name__ __main__: token1 eyJraWQiOiJlZTI3MmEzNC0zY2MwLTQ1MDQtYTNiZC0zZWUyYzg1YWNlYzEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0NTMyMzgxOSwic3ViIjoid2llbmVyIn0.djC9i0QoMSPEF8-SXVP3bZeSV9KwH4pIVpIPIOaHxx21ZWxVc7TRnt55S7KQtXOrWvG5MWreTa2s5G_V52IYfuXAid751sGeKbNt4FDJcmnfWQTLGjBLJaWxtK8xBJrG5_R8Gw-TAsMZ9FsEITucjTg7BcdyYyY3xbHAbw_Q-Xfuew9ChGf8ym2hH8Rn02sbnKy5wONeS6cj5VASwRACuWP55axOEtNRg9zec9KVOBuXB0aSkkpsj2XuLaqKeBDp7ixmH2MvtWIDBsKWhmqLh9N1Sou5m_MA4POYOWX_1BmmKwl86N4BgQpiZSMJV7837I43NBtfYJc6_u5Jy9fxRA token2 eyJraWQiOiJlZTI3MmEzNC0zY2MwLTQ1MDQtYTNiZC0zZWUyYzg1YWNlYzEiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc0NTMyMzgyNywic3ViIjoid2llbmVyIn0.fyjZG4GZst5-z6vqETs3gW4MZ7jHexfVqly5qypWsFhq0GKL4G-0tf6PkJgAD86f78NMyBhDm1JPpydmecwDoY0O4HLRyHDmrOjKeKr6tTFqN6SBu84YO7t10oKRd2UBIoVdA9gQePAgslM0AEdfpyYEf6ZN_Waut9jC6GLjCQJ3rucy6OexeT-Qkj65Dbcjvd2achWtlfiVP0Dsl1H_7VQogfNk-79l8URdl8gYFarnaBNhTyqCVkYH0yangrKyZlBUks90S3oIDGLaxxezwtaIesGQkdnIL-pWq0zDAJCJ-XSvCZ094pnXL2s5g6FxgegI0xlWA7V6ne6VhjlM-g output run_sig2n(token1, token2) print(output)在kali中运行脚本出来的结果中选择复制Base64 encoded x509 key:之后的内容作为签名密钥LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFxcjg4RXBwbHc2QXdSRW5jbUlWOApiMG5vVm9KZFhQbHQvVmIvWGNQYjVuMTBaOXc3TkVUYlZRTGZxM1FKUU9yTEQralpCZForMWkwSk1YNjBJZng4Cm10Ym16clpLOGxyZ1RycTgyc3oxZWZaMVN1MWRSMWp4T2tUQm9pOCtJUTREQ293enFMSEJySGkxUGRsR0h4d0gKUkwyLzBaMzN4bmhRUFpseGR1a2tlZnl6dXFld2dlVG5wWmR2RHRqeXY1MGxEbU1jVjJmZUcxSlN4ZmpMWEpoaApwQnhUem9GZVVLUzBLeG5yckF4WVV1b3FsSVZsQlE0MmI3UkdvY1hvVTZBekFDZzFyNnBuZ2JIaFR5azk0WkxjCk9ZNHBvcWZMMFFBOVU2TTZ1UWZ4dTluTkdOVUc4R3ZpZVhpMnZUNXJUdmRKOHd1V3hXVkVOTndNanRadTd0c2EKUVFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg将第二次登录的jwt放到jwt.io中修改alg 为 HS256sub改为管理员密钥使用脚本弄出来的签名密钥然后将新构造的jwt粘贴到第二次登录的get包中修改为/admin发送得到删除herf然后修改/admin为删除herf发送后点击重定向成功通关