So the next step for this is where do we go from here,
to modify the code to fix this problem?
Now, the JWT code is a little bit
complex and it does build on a bunch
of different things that
the OWASP engineers or
the person behind this lesson chose to do.
So I'm going to walk you quickly through some of the code
before you get started and then I'll give you
a chance to modify the code.
So every time we are switching users,
on Page 4, when you're switching users,
it's actually calling this method and
it's building a user for you by default
so it's putting admin false for all of
them and when you go to test your code,
I recommend maybe taking
one of the users and we know Tom,
Jerry, and Sylvester are the three users.
I recommend putting an if statement in here to
maybe make one of them admin by default so that
you can test your code without
having to actually hack it and so that
the actual claim that's put there is
properly signed with a signature that they had in here,
so the way I would do this is,
I would put a simple if statement if user.
and I don't remember
if it comes in as lowercase or uppercase,
I'm just going to take the user and make it lowercase
and test to see if it has Tom in it for instance.
So on the else,
we're going to keep it as false
but if it is Tom we're going to make him admin.
So just know that it should
work on Tom but it should
not work on all the other users.
When you go to do
that through the repeater to do the attack,
don't use Tom because Tom is
obviously an admin so
you don't even need to modify
any of the tokens that are being set.
So that's Part 1.
The reset which is what gets called when you hit
that trashcan icon is at the end of the page,
JWT votes endpoint.Java,
and something in this method is wrong,
and it's not properly validating
the tokens as they're coming across.
So you can take a look at
that and I'll just give a small hint here,
the parse method is
supposed to send a signature exception.
However, if you look here,
the documentation for it reads parses as
s specific compact serial JWT string based on
the builders current configuration state and
returns a JWT or JWS instance.
This method returns a JW based on what it takes in.
If you actually look at the signature exception,
the documentation for it's says,
"If the JWS signature was discovered."
Meaning that if the signature is not a JWS signature,
it's just a regular JWT,
it's not going to check the signature for it.
So that's the implementation of the parse.
So that's a little bit trick to get you started.
There's a lot of ways you can go about this.
So I will have a hint video,
just so that you don't have to re-engineer everything.
In fact, the JWT class
is something that was written specific for this project,
so it doesn't have some of the facilities like verify
token that you'll find
in some of the recommendation pieces.
If we go to search for
JWT OWASP cheat sheet,
there are some hints about how to go about doing this.
If you actually look the attack that
we just did was the none hashing algorithm,
and JWT verifier is a way of going about this.
Now, I'll give another hint on another video,
if you want to try this without the hints
and see if you can get the token to be verified.