JWAT...Attacking JSON Web Tokens

Instructors - Louis Nyffenegger & Luke Jahnke

Pre-Requisites - The students should be able to use Burp and write some basic scripts in the language of their choice. They will also need to be familiar with VMWare or the virtualization software of their choice.

Abstract - Nowadays, JSON Web Tokens are everywhere. They are used as session tokens, Oauth tokens or just to pass information between applications or microservices. By design, JWT contains a high number of security and cryptography pitfalls that creates interesting vulnerabilities. In this workshop, we are going to learn how to exploit some of those issues: the none algorithm, guessing the hmac secret, using a public key as a hmac secret... and finally CVE-2018-0114: a bug in the Cisco's Node JOSE.

Required Materials - A laptop with 4Gb of RAM and the virtualization software of their choice. Internet access during the class.