{"id":6625,"date":"2020-12-31T14:58:16","date_gmt":"2020-12-31T09:28:16","guid":{"rendered":"https:\/\/www.varutra.com\/?p=6625"},"modified":"2022-12-02T14:42:13","modified_gmt":"2022-12-02T09:12:13","slug":"json-web-token-jwt-attack-most-common-scenarios","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/json-web-token-jwt-attack-most-common-scenarios\/","title":{"rendered":"Json web token (JWT) Attack – Most Common Scenarios"},"content":{"rendered":"

<\/p>\n

What is a JSON web token (JWT)?<\/strong><\/h3>\n

A JSON web token (JWT) token is an open standard which defines the compact and secure way of transmitting data or information as a JSON object between two parties. It is considered secure as it is digitally signed. Since the information transmitted is signed digitally (using a secret key or private\/public key pair), it can be trusted and verified at the receiver end.<\/p>\n

A JWT token still makes a claim with respect to the parties who have signed it. It can also be encrypted to provide secrecy. Signed tokens help parties verify the integrity of claims contained in them but the encrypted tokens do not reveal those claims to other parties. Upon signing a token using public\/private keys, the signature also certifies that the party having the private key is the one who signed it.<\/p>\n

<\/h3>\n

When is JSON web token (JWT) used?<\/strong><\/h3>\n

It is mostly used in two scenarios<\/p>\n

1. Authorization<\/strong><\/p>\n

JWTs are most commonly used for authorization. Every subsequent request, after a user logs-in, will contain a JWT token with it, which allows the user to access services, routes, resources, etc., that are allowed with the token. JWTs are widely used in the Single Sign-On feature due to minimum overhead and its ability to be used across various domains.<\/p>\n

2. <\/strong>Information Exchange<\/strong><\/p>\n

JSON Web Tokens (JWTs) are a good way to transmit information between parties securely. Since it is possible to sign JWTs using public\/private key pairs, you can be confident that the senders are who they claim they are. You can also verify that content is not modified via the signature because it is calculated using the header and the payload.<\/p>\n

\"JWTFig -1.1 JWT Decoder<\/strong><\/pre>\n
 <\/p>\n
Structure of JSON web token (JWT)<\/u><\/strong><\/h3>\n
The JWT token comprises three parts which are separated by ( . )<\/p>\n
    \n
  1.  Header<\/strong>: It consists of two parts; the token type used (JWT), and the signing algorithm used like RSA, HMAC, or SHA256.<\/li>\n
  2.  Payload<\/strong>: Payload is the part of a JWT that contains claims. Claims define statements about the user (entity). There are 3 types of payload claims; Registered, Private, and Public claims.<\/li>\n
  3.  Signature<\/strong>: The signature is typically used to verify the integrity of the data, so that it remains original or untampered.<\/li>\n<\/ol>\n
    It is created by the server using:<\/p>\n
    Algorithm {header + payload} — secret key<\/p>\n
     <\/p>\n
    What Is the Use of KID Parameter in <\/strong>JSON web token (JWT) <\/strong>?<\/strong><\/h3>\n
    The key ID (KID) header parameter indicates the key that was utilized to secure the JWS and enables originators to clearly show recipients that a change of key has taken place. There is no specified structure of the KID value; however, its value must be a case-sensitive string.<\/p>\n
     <\/p>\n
    How to recognize a JWT token?<\/strong><\/h3>\n
    JWT token usually starts with base64 char “ey” and it is separated by two dots(.)<\/p>\n
     <\/p>\n
    Algorithms<\/u><\/strong><\/h3>\n
    1.Symmetric<\/u><\/strong><\/p>\n
    In the Symmetric mechanism, only one key is required to create and verify the JASON web token. The most common algorithm for this mechanism is HS256.<\/p>\n
    2.Asymmetric<\/u><\/strong><\/p>\n
    In the Asymmetric mechanism, two different keys are required; a Private<\/strong> key for signing the signature and a Public<\/strong> key for verification. For this mechanism, the most common algorithm is RS256.<\/p>\n
    Various signature methods can be utilized to verify the integrity of a JWT such as<\/p>\n