In this video, we're
going to cover another authentication flaw. This time, we're going
to be doing it with JWT, JSON Web Tokens. So JSON Web Tokens are an interesting thing
to work around, because based on the RFC, they're digitally in
cryptographically signed. So by the nature amount that feels like that it should
be trustworthy and this authentication flaw comes from not fully understanding how JWT tokens work and how to validate
them and verify them. So let's dive into them a little bit if you have
no idea what they are. JWT tokens are essentially a three-part token that's
sent and deciphered. So this looks like gibberish, but it's actually
base-64 encoded data. It's separated by dots. So the first base-64
encoded data is the header, the second is the set of claims, and the final is a signature that validates that all
of this is true, meaning that if the user
modifies the claim, the signature should be able to verify them and validate that, and there should be
no way to omit this. So let's look at what
those headers look like. So the header is saying
something essentially like what algorithm
are you using, so shots 56, what type are you? It's a JWT token, and the claims are
application defined. So when is expiration date,
what is a username? What scope? What
authorities do you have? So this is where things like our back role-based
access control comes in, and you can have roles
given to this individual. Now, we can see that
without the signature, this would be really
dangerous because I can just give myself the admin role
if I didn't have it. So let's look at
the threat model of this. The browser does opposed with a username login and password. We've seen that many times
by now in our bird proxy. The server creates
a JWT token with a secret, what we essentially
saw on the last page, and returns it to the browser. The browser sends that
back with the header, every single requests they make. Depending on their requests, if it's critical or if
it's a request that requires the verification of JWT, the signature is checked, the user information is verified, and as long as
everything checks out, it is returned back
to the client. So there is one space for sending off where the attacker
could modify the JWT token and potentially bypass some certain authentication or even certain authorizations. So let's play with
this really quick. We have some features here to simulate a website that
has many different roles. Now, WebGoat can be
buggy sometimes. So this drop-down
should open for you, and you should have the three individual
users and a guest. So I just selected Guest, and it says welcome back guest. If I try to vote, I'm not allowed to vote as
a guest to user. I can pretend to be Tom, and I try to vote as Tom. Obviously, you can see
the votes are going up. I can become Jerry, and
I can vote as Jerry. I can become Sylvester, and I can vote as Sylvester. Now, what the goal is
for us to be able to delete a particular item in here. You notice that we can't do that, and we have to be admin
to have those rights. So Tom can't do it, Jerry can't do it, and certainly guest can't do it. So the question becomes
what is being sent, and what is being
received on the backend? So let's look at our bird proxy. We just sent a ton
of traffic to this. So I'm going to
scroll all the way down towards
my most recent traffic. Let me make this bigger for you. So we can look at
our post requests. There was a reset requested, and what was returned is
that you cannot do this. So this requests
didn't have a body. The previous post
that was requested, it was also responded that you need to be
an admin for this one. So unlike our second one where he said you need a JWT token, we can see that in our request there's no token being sent off. Therefore, we got a response
that you need a token. This one, we said only an admin
can reset the votes. We can see that there's a
token associated with it. All right. So let's
look at this token. I'm going to copy
this entire bit of texts. There's a really cool tool
that I like to use for things like this. So it's called CyberChef. It allows us to take
a bunch of text, and I can ask it to bring it
back from a base-64 for me. Now, it does have dots which is technically
not in base-64. This is something that's in
this specification of JWT. So I'm going to delete that and replace it with line returns. What the JWT token header
was to begin with. We have a algorithm
that is HS512, and it looks like
the message that's in here is iat some number I'm
not sure what that is, whether or not I'm
an admin and some stuff that is probably
from the signature. So I'm just putting a little space between them
so you can see the end of it. Actually, let me
remove the signature. So the signature isn't
something that we can turn into a text. It's nothing meaningful to us. So if we wanted to go back
and somehow modify this, the question is how
do I go and make myself an admin without breaking that signature that
we took out a second ago and still have the
application allow us to do that? So go ahead and give it a try. You're going to probably want to use it a repeater for this, and we'll cover it
on the next video.