JSON Web Token XIV: Algorithm Confusion with ECDSA
This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key
In this course, you will learn how to exploit a vulnerability in the JSON Web Token (JWT) authentication mechanism. JWTs are commonly used for token-based authentication by embedding user data in a cryptographically-signed token. This lab focuses on a specific weakness where the algorithm for token signing can be altered, allowing an attacker to spoof tokens and gain unauthorized access.
The vulnerability arises from the ability to change the algorithm from ECDSA (Elliptic Curve Digital Signature Algorithm) to HMAC (Hash-based Message Authentication Code). By doing so, the application verifies the token using the public key as the HMAC secret, which compromises the security. You will learn to decode the JWT, modify the algorithm, and generate a new signature to exploit this weakness. The course also covers the practical aspects of recovering public keys and signing tokens to access the application as an administrator.