How Hackers Bypass JWT Token Authentication
Learn how hackers can exploit vulnerabilities in JWT tokens and discover how to improve the security of your web applications.
JSON Web Tokens (JWT) are a popular method of authentication and authorization in web applications. A JWT token is a compact, URL-safe way to transfer claims between parties. It is made up of three parts: the header, the payload, and the signature. The header contains information about the token type and the algorithms used, the payload contains the claims (user data), and the signature is used to verify the integrity of the token.
1. Reusing tokens
If a hacker steals a valid JWT token, they can use it to gain access to protected resources without proper authentication. This can happen if JWT tokens are not properly managed or if the server is not properly configured to automatically expire JWT tokens after a certain time. If a token doesn't expire in time, a hacker can reuse the stolen token to gain access to protected resources.
2. Modifying the token payload
A hacker can try to manipulate the contents of the JWT token, for example by changing the signature or altering the contents of the token. If the hacker can adjust the signature, they can gain access to resources that are only available to authenticated users. If the contents of the token are changed, the hacker can, for example, impersonate another user in order to gain access to protected resources. In the example below, the hacker changes their role from is_admin:false to is_admin:true
{ "sub": "1234567890", "name": "Bob de jong", "is_admin": false }
It can be made to look as though this user is 'admin' if there is no proper validation on the signature.
{ "sub": "1234567890", "name": "Bob de jong", "is_admin": true }
3. Brute-forcing JWT tokens
Another way hackers try to crack JWT tokens is through brute-forcing. This means the hacker tries to guess the signature of the token by systematically trying different combinations of data until the correct signature is found.
The signature of a JWT token is generated by a cryptographic algorithm such as HMAC or RSA, which uses a secret key. If the hacker can discover this key, they can generate the token's signature and grant themselves access to protected resources.
To brute-force it, the hacker can, for example, use a list of commonly used passwords or keys and try them until the correct key is found. However, this can be a lengthy and time-consuming process, especially if the key is strong and complex.
To prevent brute-forcing, it's important to use a strong and complex key to generate the signature of the JWT token. This means the key must be long enough and consist of a combination of uppercase letters, lowercase letters, numbers, and special characters.
You can test for yourself whether the JWT token at your organization is secure by using a tool like jwt-cracker. This tool can be found here on github.
Example
jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -a abcdefghijklmnopqrstuwxyz --max 6
In addition to JWT tokens, cybercriminals also frequently abuse APIs (Application Programming Interfaces). These APIs create a connection between different applications. If you're curious about how cybercriminals abuse APIs, read our blog!
Want to check your Cyber Security?
Despite this blog, do you still have questions about the Cyber Security measures your organization has in place? Then get in touch with us. At Tozetta, we are the specialists in pentesting. A pentest can be carried out on an internal network, web application, or mobile application. We're always happy to think along with you, without obligation. We're always willing to carry out a free QuickScan, which results in a proposal for a pentest. Would you prefer to continuously test for vulnerabilities in your cyber security? Then consider one of our hacking as a service subscriptions.