Скачать или смотреть JWT Vulnerabilities List (Simple Explanation)

JWT vulnerabilities:

Tamper without modifying anything
Modify the algorithm to none
Bruteforce weak signing key
Privilege Escalation by JWK header injection (RS256 or asymmetric hashing algorithm attack)
Privilege Escalation by JKU header injection (RS256 or asymmetric hashing algorithm attack)
The exploitation of kid header in JWT (Directory Traversal and command Injection) (RS256 and HS256)
Privilege Escalation by algorithm confusion when server public key is exposed and JWT token algorithm is RS256(Change the algorithm from RS256 or asymmetric hashing algorithm attack to HS256 or symmetric algorithm)
Privilege Escalation by algorithm confusion when server public key is not exposed and JWT token algorithm is RS256(Change the algorithm from RS256 or asymmetric hashing algorithm attack to HS256 or symmetric algorithm)
Cross service relay attack
Check exp

https://lazyhacker22.blogspot.com/202...