IntermediateFREE9 hours
What Are JWTs?
// VULNERABLE: JWT accepts 'none' alg + weak secret + no exp check
Enroll for free to track your progress through this course.
Curriculum (17 lessons)
- 1. What Are JWTs?
- 2. What Are JWT Attacks?
- 3. What Is the Impact of JWT Attacks?
- 4. How Do Vulnerabilities to JWT Attacks Arise?
- 5. How to Work with JWTs in Curl
- 6. Exploiting Flawed JWT Signature Verification
- 7. Brute-Forcing Secret Keys
- 8. JWT Header Parameter Injections
- 9. JWT Algorithm Confusion
- 10. How to Prevent JWT Attacks
- 11. Algorithm Confusion Attacks
- 12. Symmetric Vs Asymmetric Algorithms JWTs Can Be Signed Using a Range of Different Algorithm
- 13. How Do Algorithm Confusion Vulnerabilities Arise?
- 14. Performing an Algorithm Confusion Attack
- 15. Deriving Public Keys From Existing Tokens
- 16. Best Practices & Detailed Takeaways
- 17. None Alg Exploit (Detailed)