WEBVTT 0:00:03.700000 --> 0:00:06.620000 Hello everyone and welcome to this video. 0:00:06.620000 --> 0:00:10.680000 In this video we're going to be taking a look at the dangers posed by 0:00:10.680000 --> 0:00:17.760000 exposed claims in the payload section of a JWT token. 0:00:17.760000 --> 0:00:22.080000 And the objective here is to show you that if sensitive information like 0:00:22.080000 --> 0:00:29.920000 let's say you know a password is stored within the payload section of 0:00:29.920000 --> 0:00:35.960000 a JWT token. You know sort of show you how easily it is to decode that. 0:00:35.960000 --> 0:00:39.720000 Obviously as you've been able to tell but also something that you should 0:00:39.720000 --> 0:00:44.340000 be aware of or you should keep your eye on in terms of you know implementing 0:00:44.340000 --> 0:00:46.040000 or testing for this. 0:00:46.040000 --> 0:00:52.040000 The bottom line is that you know in most cases the JWT tokens are going 0:00:52.040000 --> 0:00:56.060000 to be relatively secure and you're not going to find anything you shouldn't 0:00:56.060000 --> 0:01:02.040000 find in the payload section of the JWT token but in some cases you may 0:01:02.040000 --> 0:01:03.660000 find some very interesting information. 0:01:03.660000 --> 0:01:10.200000 It does not need to be you know that juicy or that interesting as a password 0:01:10.200000 --> 0:01:14.180000 would but there could be other information that could you know probably 0:01:14.180000 --> 0:01:19.300000 give you a better idea as to you know how the web application works or 0:01:19.300000 --> 0:01:21.480000 the API endpoint works etc. 0:01:21.480000 --> 0:01:24.840000 Anyway there's nothing really theoretical to dive into in terms of this 0:01:24.840000 --> 0:01:30.580000 vulnerability because I sort of explained claims in the JWT introductory 0:01:30.580000 --> 0:01:35.720000 video. So if you're if you've forgotten about them just revisit that video, 0:01:35.720000 --> 0:01:41.120000 those slides. So this video has a lab environment associated with it and 0:01:41.120000 --> 0:01:43.720000 it's going to be the lab just below this video. 0:01:43.720000 --> 0:01:47.700000 It's going to be very similar to the lab we used in the previous video. 0:01:47.700000 --> 0:01:51.500000 So just keep that in mind you'll be provided with access to a pre-configured 0:01:51.500000 --> 0:01:52.740000 calilinic system. 0:01:52.740000 --> 0:01:55.820000 With that being said let me start off my lab and I'll see you in there 0:01:55.820000 --> 0:01:58.500000 in a couple of seconds. 0:01:58.500000 --> 0:02:10.440000 All right so I'm currently within the lab environment and as you can see 0:02:10.440000 --> 0:02:14.500000 I'm in the management system with a very very cool API and again it's 0:02:14.500000 --> 0:02:18.000000 going to be on the same port as in the previous video previous lab which 0:02:18.000000 --> 0:02:23.240000 was 1337. So the only thing you need to do really is get your IP address 0:02:23.240000 --> 0:02:27.480000 the IP address of your calilinic system which you can get by typing in 0:02:27.480000 --> 0:02:32.660000 IF config. Look for the network interface ethernet 1 and the iNet address 0:02:32.660000 --> 0:02:42.100000 and in your case it'll be so I'm going to do exactly that and I'm going 0:02:42.100000 --> 0:02:48.040000 to maximize my terminal here and again within the lab documentation or 0:02:48.040000 --> 0:02:53.000000 the documentation for this lab the user name has been you know user names 0:02:53.000000 --> 0:02:57.560000 have been provided to you for authentication as well as the API endpoints 0:02:57.560000 --> 0:03:01.600000 which again exactly the same as the previous lab or previous video so 0:03:01.600000 --> 0:03:06.780000 we'll be using the user Elliot Alderson to get a JWT token. 0:03:06.780000 --> 0:03:12.420000 So I'll use curl here just to make the request to the API so curl and 0:03:12.420000 --> 0:03:18.580000 again we'll specify the header content type and that's going to be application 0:03:18.580000 --> 0:03:24.840000 JSON obviously so application JSON and then we don't need any other headers 0:03:24.840000 --> 0:03:28.800000 so we're going to make a post here really quickly and the data we want 0:03:28.800000 --> 0:03:33.660000 to include in this post is going to be in JSON format so I'll follow that 0:03:33.660000 --> 0:03:42.480000 accordingly. Identifier is going to be just Elliot so I'll just specify 0:03:42.480000 --> 0:03:49.580000 that here Elliot and then what we want to do is specify the password which 0:03:49.580000 --> 0:03:59.180000 again in this case is just going to be Elliot Alderson we make sure I'm 0:03:59.180000 --> 0:04:02.860000 typing that in correctly because I usually make these mistakes as some 0:04:02.860000 --> 0:04:09.060000 of you know and then HTTP again in your case yours will be different just 0:04:09.060000 --> 0:04:12.440000 change the two at the end to a three the port is one three three seven 0:04:12.440000 --> 0:04:17.580000 that's API port and then because we authentication because we're authenticating 0:04:17.580000 --> 0:04:24.240000 the API endpoint is auth local and I will just pipe this to JQ which again 0:04:24.240000 --> 0:04:30.100000 just displays or passes the you know JSON on your terminal in in the intended 0:04:30.100000 --> 0:04:35.580000 format or in a properly formatted format apologies for the pun there so 0:04:35.580000 --> 0:04:41.560000 I'll hit enter there we go and we get the JWT here so you can decode this 0:04:41.560000 --> 0:04:50.160000 you can decode the header the payload via the base 64 Linux utility in 0:04:50.160000 --> 0:04:55.380000 your terminal or you can use JWT.io as I showed you in the previous video 0:04:55.380000 --> 0:04:57.840000 and I think we're actually going to do that so I'm just going to switch 0:04:57.840000 --> 0:05:03.580000 into my JWT.io tab and show you what this looks like all right so I'm 0:05:03.580000 --> 0:05:08.080000 currently in JWT.io and I'm just going to get rid of the previous JWT 0:05:08.080000 --> 0:05:12.220000 that we forwarded in the previous video and paste this one in and I want 0:05:12.220000 --> 0:05:17.420000 you to pay very close attention to the payload section or part of the 0:05:17.420000 --> 0:05:21.200000 token and the data contained there in so we can see we have ID that's 0:05:21.200000 --> 0:05:26.180000 sort of a public claim but we also have flag and again in this case because 0:05:26.180000 --> 0:05:29.880000 it is a lab environment you know this is the flag for the lab this is 0:05:29.880000 --> 0:05:33.360000 what you are supposed to find but my point or the point of this video 0:05:33.360000 --> 0:05:37.520000 was to show you that you may find some interesting information contained 0:05:37.520000 --> 0:05:44.720000 within the payload section or part of the JWT token and again you can 0:05:44.720000 --> 0:05:48.760000 pretty much replace this with anything that again you would consider of 0:05:48.760000 --> 0:05:53.740000 utmost importance I mentioned this in the JWT video and you know what 0:05:53.740000 --> 0:05:57.260000 types of claims to look out for but I just wanted to show you practically 0:05:57.260000 --> 0:06:02.980000 what it looks like with that being said you know that brings us to the 0:06:02.980000 --> 0:06:08.240000 end of the practical demonstration section of this video all right so 0:06:08.240000 --> 0:06:12.760000 that was exposed claims again fairly short demo you may not think it's 0:06:12.760000 --> 0:06:17.860000 important but I thought I needed to reiterate it and there's a good reason 0:06:17.860000 --> 0:06:22.320000 why I covered it after we talked about the algorithm because I'm sort 0:06:22.320000 --> 0:06:27.060000 of approaching it sequentially moving from you know vulnerabilities in 0:06:27.060000 --> 0:06:32.140000 the header to stuff that's in the payload and then we'll know we'll get 0:06:32.140000 --> 0:06:35.160000 into the signature stuff but with that being said that brings us to the