Cheesy Does it - cheesy-007

Level: Easy Points: 10 Type: Daily Challenge

Steps

• Registered and got a JWT with a role parameter

• Cracked the secret using Burp Suite's JWT Editor extension (weak HMAC secret attack) → found it was secret

• Created a new symmetric key in JWT Editor using secret

• Modified the payload:

  • Changed role to admin

  • Changed id to 1

• Signed the modified JWT with the symmetric key

• Sent the request with the forged token → worked successfully

• Accessed /api/admin/users and got the flag from the X-Flag response header