> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/jwt-none-algorithm-attack/shady-oaks-financial.md).

# Shady Oaks Financial

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/eTwnqjPbAUQFOsw82YWD" alt=""><figcaption></figcaption></figure>

After login, we get JWT as:

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NCwidXNlcm5hbWUiOiJzdXNoaWwiLCJyb2xlIjoidXNlciIsImlhdCI6MTc3MjgxMzY1M30.DlQBKe4708GVJ1jMIkpWTStnsIcxDaZXc4WJMnzN9hU
```

<figure><img src="/files/K2tvhnRJTYLbaMe76QF0" alt=""><figcaption></figcaption></figure>

edit the \
`algo` to `none` \
`id` to `1`\
`role` to `admin`

<figure><img src="/files/jMLAL3DPwtIISKJOsPOh" alt=""><figcaption></figcaption></figure>

Then send the request, we now have access to the admin panel

To get flag: GET request to /api/admin/flag

<figure><img src="/files/WHfO3zCYQcBHbQGGT9cc" alt=""><figcaption></figcaption></figure>