> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/jwt-secret-key-brute-forcing/cheesy-does-it-cheesy-007.md).

# Cheesy Does it - cheesy-007

Level: Easy
\
Points: 10
\
Type: Daily Challenge

### Steps

* **Registered** and got a JWT with a `role` parameter

<figure><img src="/files/VlYOCxb0dq4j31qrOut2" alt=""><figcaption></figcaption></figure>

* **Cracked the secret** using Burp Suite's JWT Editor extension (weak HMAC secret attack) → found it was `secret`

<figure><img src="/files/BHBzGEGW5X6uCkyy28mM" alt=""><figcaption></figcaption></figure>

* **Created a new symmetric key** in JWT Editor using `secret`

<figure><img src="/files/plDfIliiMGDZQa9i9tRh" alt=""><figcaption></figcaption></figure>

* **Modified the payload:**
  * Changed `role` to `admin`
  * Changed `id` to `1`
* **Signed** the modified JWT with the symmetric key

<figure><img src="/files/ODgo7HUCMERBLX4Y1Tjm" alt=""><figcaption></figcaption></figure>

* **Sent the request** with the forged token → worked successfully
* **Accessed** `/api/admin/users` and got the flag from the `X-Flag` response header

<figure><img src="/files/IejfFd9NzAcoF9M0iSb4" alt=""><figcaption></figcaption></figure>