文章指出，传统的Web应用安全测试方法已不足以应对所有威胁，特别是JSON Web Tokens（JWT）等新兴漏洞。JWT作为一种常见的认证和授权机制，因其编码特性常被忽视，但其潜在的攻击面不容小觑。测试者需要识别、解码、理解JWT内容，并制定相应的攻击策略。本文通过Black Hills Information Security的 webcast，深入探讨了JWT的原理、争议点及主要弱点，并结合OWASP Juice Shop演示了实际的攻击方法，为Web应用渗透测试提供了实用的指导。

🔑 JWT并非加密而是编码：JWT通常采用Base64编码，这意味着其内容并非真正加密，而是可以轻易地被解码和查看，这使得其内部信息暴露，成为潜在的攻击入口。因此，在安全测试中，识别和解码JWT是发现漏洞的第一步。

🧐 JWT的复杂性与被忽视：JWT的编码特性使其在初步测试中看起来像乱码，容易被测试人员忽略。然而，攻击JWT需要经过识别、解码、理解内容、制定攻击计划、创建Payload、构建有效JSON并重组JWT等一系列复杂步骤，这增加了攻击的门槛，但也意味着一旦被攻破，其影响可能更为深远。

💡 实操演示与工具推荐：文章介绍了Black Hills Information Security的一个 webcast，该 webcast深入探讨了JWT的原理、争议点以及如何测试其主要弱点。通过使用OWASP Juice Shop这一靶场，演示了一种直接的JWT利用方法，为实际的Web应用渗透测试提供了可操作的指导和参考。

So much information about testing webapps for security problems is old. Don’t get me wrong, the old stuff still works way more often than we’d like, but there’s more to webapp vulnerabilities than cross-site scripting and SQL injection.



Take JWTs – JSON Web Tokens – for example. These are base64 encoded tokens that sometimes get written to your browser’s localStorage or sessionStorage and passed around in cookies or HTTP headers. They’re pretty common in authentication and authorization logic for web APIs.



Because they’re encoded, they look like gibberish and it’s easy to skip over them during a test. For the same reason, they’re more complicated to attack. First, you have to notice them. Then you have to decode them. Then you need to interpret the decoded data inside them. THEN, you have to decide what to attack! Once you’ve done that, you still have to create your payload, make valid JSON out of it and rebuild the JWT before you can send it.



It’s kind of a lot.



In this Black Hills Information Security webcast – an excerpt from his upcoming 16-hour Modern Webapp Pentesting course – BB King talks about what JSON Web Tokens are, why they’re so controversial, and how to test for their major weaknesses. Then, using OWSAP’s Juice Shop as a target, he shows you a straightforward method for exploiting them that you can use on your own next webapp pentest.



Join the Black Hills Information Security Discord discussion server — https://discord.gg/aHHh3u5



Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_WebApp_PenTesting_AttackingJWTs.pdf



0:00 – Good Morning!



1:50 – What Are JSON Web Tokens?



4:43 – Base64 Vs Base64 URL Encoding



7:58 – The Construction of a JSON Token



10:07 – Use Cases



13:03 – RFCs of Interest



13:26 – Encoded, Not Encrypted



19:58 – The Red Slide



<a rel="noreferrer noopener" href="https://www.youtube.com/watch?