Let's (me and chatGPT) make a custom script to crack the signature.
import jwtimport hashlibimport hmacimport base64jwt_token ="eyJhbGciOiJNRDVfSE1BQyJ9.eyJ1c2VybmFtZSI6ImNhdCJ9.C3Z8QcoVXXFa-LAzFZbZ1w"defverify_jwt(jwt_token,key):# Split the JWT into header, payload, and signature header, payload, signature = jwt_token.split('.')# Recreate the signing input by concatenating the header and payload with a dot signing_input = header +'.'+ payload# Convert the signing input and key to bytes signing_input_bytes = signing_input.encode('utf-8') key_bytes = key.encode('utf-8')# Create an HMAC-MD5 hash object hash_obj = hmac.new(key_bytes, signing_input_bytes, hashlib.md5)# Get the HMAC-MD5 signature calculated_signature = hash_obj.hexdigest()# Decode the Base64-encoded signature from the JWT decoded_signature = base64.urlsafe_b64decode(signature +"==")# Compare the decoded signature with the calculated signatureif decoded_signature ==bytes.fromhex(calculated_signature):print("Key:", key)exit(0)# Define the character set and key lengthcharset ="abcdefghijklmnopqrstuvwxyz"key_length =5# Loop through different keysfor i inrange(len(charset) ** key_length): key =""for j inrange(key_length): key = charset[i %len(charset)]+ key i //=len(charset)verify_jwt(jwt_token, 'fsrwjcfszeg'+ key)
Got the key!
Key:fsrwjcfszegvsyfa
Solve script #2 (forge token)
Now another custom script to forge a token with user admin.
import jwtimport hashlibimport hmacimport base64jwt_token ="eyJhbGciOiJNRDVfSE1BQyJ9.eyJ1c2VybmFtZSI6ImNhdCJ9.C3Z8QcoVXXFa-LAzFZbZ1w"key ="fsrwjcfszegvsyfa"# Split the JWT into header, payload, and signatureheader, payload, signature = jwt_token.split('.')# Decode the payload from the tokendecoded_payload = base64.urlsafe_b64decode(payload +"==").decode('utf-8')# Modify the payloadmodified_payload = decoded_payload.replace('"username":"cat"', '"username":"admin"')# Encode the modified payloadencoded_payload = base64.urlsafe_b64encode(modified_payload.encode('utf-8')).decode('utf-8').rstrip('=')# Recreate the signing input by concatenating the header and modified payload with a dotsigning_input = header +'.'+ encoded_payload# Convert the signing input and key to bytessigning_input_bytes = signing_input.encode('utf-8')key_bytes = key.encode('utf-8')# Create an HMAC-MD5 hash objecthash_obj = hmac.new(key_bytes, signing_input_bytes, hashlib.md5)# Get the HMAC-MD5 signaturecalculated_signature = hash_obj.digest()# Encode the calculated signature using base64encoded_signature = base64.urlsafe_b64encode(calculated_signature).rstrip(b'=').decode('utf-8')# Replace the characters '+' and '/' in the encoded signature with '-' and '_'encoded_signature = encoded_signature.replace('+', '-').replace('/', '_')# Create the modified JWT by concatenating the modified header, encoded payload, and encoded signaturemodified_jwt = header +'.'+ encoded_payload +'.'+ encoded_signatureprint("Modified Token:", modified_jwt)
Receive a new token, signed with MD5_HMAC using the secret key fsrwjcfszegvsyfa.
