# jwt-1

{% hint style="info" %}
Category: Web

Difficulty: very easy
{% endhint %}

## Description

> I just made a website. Since cookies seem to be a thing of the old days, I updated my authentication! With these modern web technologies, I will never have to deal with sessions again. Come try it out at <http://litctf.org:31781/>.

## Solve Walkthrough

* As you can know from the challenge title, it shoule be correlation with JWT token, so prepare for <https://jwt.io> website.
* The website have 3 features/endpoints, that is:
  * Sign up -> **/signup/**
  * Log in -> **/login/**
  * Get the flag -> **/flag**
* Of course we don't know admin password, but after you login (or signup if you don't have an account before), you can see new generated JWT token in the **Storage > Cookies** of your developer tools.
* Copy that JWT token to the jwt.io website, and you will see the payload data contain `name` and `admin`.
* I change the `admin` value to **true**, and then I replace the original JWT token cookies to crafted JWT token payload.

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2FZfBYgs5LUwtCdPv1R7H6%2Fimage.png?alt=media&#x26;token=7fb7c2be-9dec-4d00-aeec-119ee7ae83d2" alt=""><figcaption></figcaption></figure>

* When I try to visit the **/flag** endpoint, it show me the flag.

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2FvKCqrKZtYHd7jMgnB0aW%2Fimage.png?alt=media&#x26;token=b62ee0f0-8e0d-451d-9e0d-efe37469cae2" alt=""><figcaption></figcaption></figure>

## Flag

<kbd>LITCTF{o0ps\_forg0r\_To\_v3rify\_1re4DV9}</kbd>
