> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/jwt-none-algorithm-attack/tanuki.md).

# Tanuki

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/zyJKBGo4dkyERGeQ7HTV" alt=""><figcaption></figcaption></figure>

there is nothing intresting feature to check.

So, I moved onto check JWT

<figure><img src="/files/5qfvOHc374qzVjNQE6c9" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/uIySaFveVZz6aTAg1l7h" alt=""><figcaption></figcaption></figure>

Edit username field in JWT Payload<br>

<figure><img src="/files/AssiHeyykNZDsHGFAmTh" alt=""><figcaption></figcaption></figure>

Simply changing the values on JWT Payload doesnot work, I tried `none sign algortithm` and it worked

<figure><img src="/files/O0XuA369ArDSU50i3BXm" alt=""><figcaption></figcaption></figure>

Next, I changed the id, and username also

<figure><img src="/files/hxocE1PWClM1wy7D2Pqm" alt=""><figcaption></figcaption></figure>

Now use this new JWT and we will have access to admin panel

<figure><img src="/files/EZW5TjpkW9jCBZidYAg3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/znDVMnKOvg9kVLLpeLgJ" alt=""><figcaption></figcaption></figure>