One of the "signature algorithms" for JWT is "None", meaning no signature at all. If an application accepts such tokens, even if the developer hasn't considered it, the consequences are catastrophic. A JWT token with "None" as the signature algorithm looks like this:

Obtain the JWT token that the application gives you. You can see this in Burp's HTTP history when you invoke functions of the application that include the token.

Send an HTTP request containing the token to the repeater so that you can send the request again and again, always modifying the token, and see when the application accepts the modified token, indicating a successful attack.

Decode the token, change its JOSE header algorithm (alg) value to "None", and reassemble the token. You can do this in a couple of different ways, one option is Hakatemian JWT Studio (Tools -> JWT Studio):

The second option is to use BurpSuite's "JSON Web Tokens" extension:

Once you have assembled a new JWT, replace the token originally present in the HTTP request with it and resend the request.

Read the flag from the /api/v1/flag endpoint.

In this lab, you will be able to perform your first JWT attack. The goal is to log in to the application as a regular user and obtain a token that has the "admin" claim value set to 

. Then, using the techniques you have learned in this module, modify the token so that the "admin" claim value is 

. Finally, read the flag from the /api/v1/flag endpoint.

JWT Verification Bypass - 'None' Algorithm

## "None" Algorithm

One of the "signature algorithms" for JWT is "None", meaning no signature at all. If an application accepts such tokens, even if the developer hasn't considered it, the consequences are catastrophic. A JWT token with "None" as the signature algorithm looks like this:

![](sanity:image-5dab34fee36815aa2b8b4da07eb765b787482fd5-837x364-png)

---

## Step 1 - Obtain Token

Obtain the JWT token that the application gives you. You can see this in Burp's HTTP history when you invoke functions of the application that include the token.

![](sanity:image-5e6fc35126048fc6613226c55f0d59bb9bb28703-715x409-png)

---

## 2. Step - Send HTTP request to repeater

Send an HTTP request containing the token to the repeater so that you can send the request again and again, always modifying the token, and see when the application accepts the modified token, indicating a successful attack.

![](sanity:image-53dc69e1255875f4240821075337264dd11785cc-475x337-png)

---

## Step 3 - Edit token

Decode the token, change its JOSE header algorithm (alg) value to "None", and reassemble the token. You can do this in a couple of different ways, one option is Hakatemian JWT Studio (Tools -> JWT Studio):

![](sanity:image-14902201ea34e0f364d081a635022dc7069f94a9-732x226-png)

The second option is to use BurpSuite's "JSON Web Tokens" extension:

![](sanity:image-2fd78814a95b6fd056ca9cb31e1dda98377d61cc-717x426-png)

![](sanity:image-cbdc85ffd530b694dd438c0d47dcaafaefa0c09f-428x214-png)

![](sanity:image-99b377068c9a113362360084944700d570006f3f-717x426-png)

---

## 

---

## 4. Step - Victory

Once you have assembled a new JWT, replace the token originally present in the HTTP request with it and resend the request.

@exercise eda09d059491


Do Not Check This Token Thanks - JWT's Notorious 'None' Algorithm

There are JWT tokens almost everywhere you look these days. However, the choice or configuration of the JWT library often goes wrong, which can lead to token forgery, which in turn typically leads to a total breach of the application's security.

JWT tokens are almost everywhere nowadays. However, the selection or configuration of the JWT library often goes wrong, which can lead to token forgery, which typically results in a total breach of application security.

Do Not Check This Token Thanks - JWT's Notorious 'None' Algorithm

"None" Algorithm

Learn to hack — start here