Webcast: Modern Webapp Pentesting: How to Attack a JWT

So much information about testing webapps for security problems is old. Don’t get me wrong, the old stuff still works way more often than we’d like, but there’s more to webapp vulnerabilities than cross-site scripting and SQL injection. Take JWTs – JSON Web Tokens – for example. These are base64 encoded tokens that sometimes get written to your browser’s localStorage or sessionStorage and passed around in cookies or HTTP headers. They’re pretty common in authentication and authorization logic for web APIs. Because they’re encoded, they look like gibberish and it’s easy to skip over them during a test. For the same reason, they’re more complicated to attack. First, you have to notice them. Then you have to decode them. Then you need to interpret the decoded data inside them. THEN, you have to decide what to attack! Once you’ve done that, you still have to create your payload, make valid JSON out of it and rebuild the JWT before you can send it. It’s kind of a lot. In this Black Hills Information Security webcast – an excerpt from his upcoming 16-hour Modern Webapp Pentesting course – BB King talks about what JSON Web Tokens are, why they’re so controversial, and how to test for their major weaknesses. Then, using OWSAP’s Juice Shop as a target, he shows you a straightforward method for exploiting them that you can use on your own next webapp pentest. Join the Black Hills Information Security Discord discussion server — https://discord.gg/aHHh3u5 0:00 – Good Morning! 1:50 – What Are JSON Web Tokens? 4:43 – Base64 Vs Base64 URL Encoding 7:58 – The Construction of a JSON Token 10:07 – Use Cases 13:03 – RFCs of Interest 13:26 – Encoded, Not Encrypted 19:58 – The Red Slide 20:39 – OWASP Top Ten Issues

• (00:00) - Good Morning!
• (01:47) - What Are JSON Web Tokens?
• (04:36) - Base64 Vs Base64 URL Encoding
• (07:46) - The Construction of a JSON Token
• (09:50) - Use Cases
• (12:38) - RFCs of Interest
• (13:00) - Encoded, Not Encrypted
• (19:10) - The Red Slide
• (19:50) - OWASP Top Ten Issues
• (20:10) - Signature Al Gore Rhythms
• (24:30) - Stanced On Privacy
• (25:48) - Stanced On Security
• (27:45) - Craking
• (29:04) - Where To Practice
• (33:27) - Decoding the Payload – (Visual DEMO)
• (42:52) - Snooping ( Stealing Poorly-Protected Secrets )
• (48:27) - For Further Study