JSON Web Token Security

Поділитися
Вставка
  • Опубліковано 11 лис 2024

КОМЕНТАРІ • 239

  • @LoiLiangYang
    @LoiLiangYang  3 роки тому +239

    Tom and Jerry

    • @hemantmehra3826
      @hemantmehra3826 3 роки тому

      Great 👍🏻

    • @anonymouscharles6499
      @anonymouscharles6499 3 роки тому

      Hi

    • @nuneunop
      @nuneunop 3 роки тому

      HELLO!

    • @vipinkumar-kf6jr
      @vipinkumar-kf6jr 3 роки тому +1

      Hello Sir thank you so much for your informative video, you're an inspiration for anyone who wants to be like you. I love your videos so much, you have varieties, good explaintions, and no doubt you're great at what you do😇 Thanks a lot again. 🙏

    • @alangeorge4923
      @alangeorge4923 3 роки тому +1

      Mr loi ,I installed an app which I think is from a hacker and im pretty sure that he was trying meta exploit ,anyways I deleted the app, am I safe ? Should I be concerned ?

  • @eric9493
    @eric9493 3 роки тому +71

    It is amazing that there are educational tools like bogus webpage and video to teach or train newcomers in the concept of hacking unlike before. Over the decades, technology and techniques have evolved so much that it feels daunting for newcomers for survive the steep learning curve. Though some techniques may not work in current state, these tools help to smoothen the learning curve and hopefully, will attract more new blood to the field of cyber security.

    • @lucifermorningstar1082
      @lucifermorningstar1082 3 роки тому

      its like paper trading the stock market useless in the real world

    • @eric9493
      @eric9493 3 роки тому +2

      @@lucifermorningstar1082 Like I have said, it may not work in current world but new knowledge is built on top of old ones. Knowing old concept merely serves as a stepping stone to develop other techniques. Just like how the earliest form of blockchain started in 1991 as Surety timestamping solution and improved upon by others. Eventually, the technology can be combined with other techniques to create a system to fit a wide range of applications.

    • @mobus1219
      @mobus1219 3 роки тому

      @@lucifermorningstar1082 Its only for demonstration

  • @crayfish7542
    @crayfish7542 3 роки тому +20

    After reading Only the " Thumbnail " the Title, and the 1st., 6 seconds / I have to say; " Thank you " ! I get to do That Every time I go to the Grocery Store or Look into Any Catalog !

  • @salientExtract
    @salientExtract 3 роки тому +8

    This is great and all but most secure applications will not use the alg header to determine what algorithm to check the signature with, and they will check the signature with a predefined algorithm rejecting any claims in the JWT if the signature doesn't match the content of the token. So this would work on apps developed and not updated before 2015 I think.

  • @sailorm79
    @sailorm79 3 роки тому +179

    I'm guessing this works on applications that don't actually validate the token.

    • @anthonyg9350
      @anthonyg9350 3 роки тому +20

      Hence not a “hack” but exploiting what should be painfully obvious.

    • @mind.journey
      @mind.journey 3 роки тому +8

      No, the problem is trusting the JWT with whichever algorithm it provides. There should be a list of allowed algorithm, and the backend should only accept those JWTs whose algorithm is one of the valid ones

    • @sailorm79
      @sailorm79 3 роки тому +3

      @@mind.journey I think we are saying the same thing

    • @mind.journey
      @mind.journey 3 роки тому +2

      @@sailorm79 you're right! I interpreted your message differently but yeah, essentially they're not validating the token by trusting whatever is says

    • @Narc0YT
      @Narc0YT 3 роки тому +3

      This is also something that applies to old JWT libraries that haven't patched the fact that anyone can dump the alg as none out which some lazier web applications might not have done and these applications are most likely still vulnerable to this attack.

  • @solelgammal
    @solelgammal 3 роки тому +18

    Thanks and You Helped learn how to program websites more securely

  • @TobyArnett
    @TobyArnett 3 роки тому +22

    Great video! Short, sweet, to the point, and loaded with great practical information!!

  • @RealRogerFK
    @RealRogerFK 3 роки тому +29

    Wow! Thank you so much! With this simple hack, I managed to get a Free PS5 and a Free RTX 3090

  • @-dr4k3n66
    @-dr4k3n66 3 роки тому +29

    Now i can order my dream pc 👀

    • @Henyxo
      @Henyxo 3 роки тому +3

      Yooo, did you do it? 😂

    • @zerodark1262
      @zerodark1262 3 роки тому +1

      come back let us know brobro im literally on kali linux trinaa see if it real jaja

    • @Gupatik
      @Gupatik 3 роки тому +5

      and go with it to jail

    • @harze434
      @harze434 2 роки тому

      FBI OPEN UP😂

  • @ZAMislive
    @ZAMislive 3 роки тому +9

    gonna get 2 pairs of ipad pro, imac, earpods, zara, 1gbps annual pack, 1 bitcoin{at least}
    guys, i just wanna tell you that Dreams come true!

  • @stolenkey
    @stolenkey 3 роки тому +23

    This was incredibly interesting to watch, thank you!

  • @deadshot1137
    @deadshot1137 3 роки тому

    watching your vids with my new iphone,you are the best

  • @dermuschelschluerfer
    @dermuschelschluerfer 3 роки тому +5

    If you validate the token it wont work. These tokens are not there to ensure the data is right, but they are there to ensure that the data is valud by providing the data, key and a token. The server computes the token from the data and compares it to the token sent with the jwt. If you dont validate this in your application, you can use any data

  • @Warlock1515
    @Warlock1515 3 роки тому +2

    I learned tons about the JWT token in this concise video that I didn't know before! Thanks for the hard work; Keep it up!!

  • @吕清泰
    @吕清泰 3 роки тому +17

    Not sure what you were doing here, you changed the JWT, how could it pass the server JWT verification? The server will use key and salt to decode the token, if you not put signature, it won’t pass

    • @alb12345672
      @alb12345672 3 роки тому

      @@K3dev My boss told me to drop a date with a salt code the payload. Then check it on the server. (e.g.

  • @yaserbasaad7984
    @yaserbasaad7984 3 роки тому +7

    Thanks for educating Community. waiting for more ..

  • @sujaldarode1649
    @sujaldarode1649 3 роки тому

    love and support from India

  • @SECYBERSAFE
    @SECYBERSAFE 3 роки тому +9

    Excellent tutorial, but it won't work on present day website at least most of them. Could work on a few

    • @justa1guy5
      @justa1guy5 3 роки тому +5

      His tutorial is outdated! Besides cyber security expert are not a fool
      Who would just sit there and be like;
      C,Mon boy u can do it

    • @AB-nv6fh
      @AB-nv6fh 3 роки тому

      @@justa1guy5 can you explain more please

    • @georgiabrooks5631
      @georgiabrooks5631 3 роки тому

      Could you help me work out how to do it with amazon?

    • @SECYBERSAFE
      @SECYBERSAFE 3 роки тому

      @@georgiabrooks5631 do a search online you will find it. It is still same process

  • @mohammednuredin3004
    @mohammednuredin3004 3 роки тому +3

    Love from Ethiopia 🇪🇹

  • @suhanulkabir2959
    @suhanulkabir2959 2 роки тому

    I love ur tutorial...
    How can I learn about hacking from ur courses? tell me pls..

  • @Abasalt_Yar
    @Abasalt_Yar 3 роки тому +1

    Hello, Awesome Video. Please make another one about sessionids

  • @professorummarsheikh7375
    @professorummarsheikh7375 3 роки тому

    please make more videos and guide us more about check out or payment methods

  • @adriansony9762
    @adriansony9762 Рік тому

    Really nice video

  • @CyberBoy_69
    @CyberBoy_69 3 роки тому +20

    Thanks a Ton for Giving Such a Great Content for Us.

    • @awli8861
      @awli8861 3 роки тому +1

      Thank a Tom!

  • @SamerLOLOfficial
    @SamerLOLOfficial 3 роки тому +1

    I like this video, Thank you.
    In near future I will buy your course.

  • @mikeellam6365
    @mikeellam6365 3 роки тому

    Mr. Loi Liang Yang.
    Which programming languages did you use to hack?

  • @mulayamyadav2987
    @mulayamyadav2987 3 роки тому +1

    Love your videos

  • @tengelkewasserrim4464
    @tengelkewasserrim4464 3 роки тому +1

    Sir i hope you to answer 🙏 to my question please "i have my WIN OS run i run a VPN on it and i launch WHONIX in a VM now which IP will be the exit point 👉 the TOR ip or the VPN ?" thank you.

  • @anonymousnothing5861
    @anonymousnothing5861 3 роки тому +2

    sir can you make video about webgoat how to use full tutorial plz

  • @bryanmichaelzapatacapcha6701
    @bryanmichaelzapatacapcha6701 3 роки тому

    If the JWT is generate with private key and public key, that is vulnerable?

  • @7V999
    @7V999 3 роки тому +1

    WARNING!
    00:16 - LEGO
    00:19 - WARNING!

  • @saikrishnavinjamuri4058
    @saikrishnavinjamuri4058 3 роки тому

    What's your monitor??

  • @neverreality5150
    @neverreality5150 3 роки тому

    Wow great video

  • @sachinmishra4657
    @sachinmishra4657 3 роки тому

    but sir what about price who will pay for me and how i didnt get it can you tell somting about peramitor tempring

  • @admiralarjun
    @admiralarjun 3 роки тому

    You forgot to add "from a pro hacker" to the end of title.

  • @thecatishere.
    @thecatishere. 3 роки тому +2

    8 minutes ill never get back

  • @Hello-d8z
    @Hello-d8z 3 роки тому

    Iam ur big fan bro

  • @agents_of_hydra1859
    @agents_of_hydra1859 3 роки тому

    Op knowledge bro 🖤

  • @KekzFPS
    @KekzFPS 3 роки тому

    I really appreciate and like your videos, but why do you always add keyboard and mouse sounds? Is it an insider I dont know or just for fun?

  • @dracenmarx
    @dracenmarx 3 роки тому +7

    I don't like this approach using the Burp suite. You teach people how to use Burp, but they don't understand what's behind this, how and why it works. I would prefer if you teach it in vanilla style, i.e. no fancy tools or frameworks, so people understand what is really going on. Of course, it takes more time to understand then.

    • @Gupatik
      @Gupatik 3 роки тому +1

      but then you won't be caught, and this is not a real shaking tutorial, but it's completely the step by step for beginners, he also didn't want to mention VPN or proxy chains.

  • @kphamcao
    @kphamcao 3 роки тому +4

    This works if the server doesn't validate the algorithm.

    • @Kitulous
      @Kitulous 3 роки тому +2

      which is dumb and defeats the purpose of a JWT altogether

    • @VuNguyen-ni4ex
      @VuNguyen-ni4ex 3 роки тому

      Honestly I don't think this will works anywhere

    • @kphamcao
      @kphamcao 3 роки тому

      @@VuNguyen-ni4ex a hacker can always hope someone forgot to validate. It is a common enough mistake that implementations take care to remind people to validate the algorithm.

    • @VuNguyen-ni4ex
      @VuNguyen-ni4ex 3 роки тому

      @@kphamcao I think people now are using libraries that supports JWT really well, so yea that's really rare

    • @kphamcao
      @kphamcao 3 роки тому

      @@VuNguyen-ni4ex depends on which ecosystem you are talking about. The jwt library in Golang for example allow you to not verify the algorithm. Note that there is still a use case for not checking the signature if the parties in communication have mutual trust.

  • @bananaman8085
    @bananaman8085 3 роки тому +1

    Does this work for taxes

  • @houdine5152
    @houdine5152 2 роки тому +1

    if your backend accepts jwt tokens with no algorithm assigned to it then you need to just delete your entire project cause youse definitely already got a backdoor installed on your servers.

  • @sevideos7356
    @sevideos7356 3 роки тому

    You are amazing

  • @ArthabRisal
    @ArthabRisal 2 роки тому +1

    I didn't get please sir can u make another video on this topic please sir I didn't understood. I am just 16 years sir I begggg yo please make how did you do this. Ethical hacking is my passion

  • @sampearson3752
    @sampearson3752 3 роки тому +1

    do you prefer to install kali linux on bare metal or virtual machine?

    • @mandar3813
      @mandar3813 3 роки тому +1

      i would prefer bare metal and just dual boot.

    • @TobyArnett
      @TobyArnett 3 роки тому +1

      I prefer bare metal for actual testing. Virtual is great for learning and those without access to another machine, but the bare metal has more inherent abilities since it isn't working on virtualized resources.
      A good option is a raspberry pi4 with a Kali ARM distro. You can set up actual RDP and remote to it from a windows machine (not vnc - but rdp). Then you get the full bare metal experience for about 100.00

  • @GeekTechTutorial
    @GeekTechTutorial 3 роки тому +1

    Omg thank u for demo.

  • @hoodyboy6741
    @hoodyboy6741 3 роки тому

    Grats on the 420k

  • @sujaldarode1649
    @sujaldarode1649 3 роки тому

    big fan sir

  • @omaanshkaushal3522
    @omaanshkaushal3522 3 роки тому +1

    Which OS do you use? I am new to this channel. Can you suggest me something?

    • @Gupatik
      @Gupatik 3 роки тому

      kali linux, and becarful don't miss around if you're new, take your time

  • @Mike-kq5yc
    @Mike-kq5yc 3 роки тому

    Can you pls give the list of names of books that are lying on your table at 0:19?

  • @admin_user8960
    @admin_user8960 3 роки тому

    Thanks Master...

  • @elsdq7215
    @elsdq7215 3 роки тому +7

    First here…. Love his tuts so much 🤩

  • @nusn43
    @nusn43 3 роки тому

    Mantap bro you are really hacker

  • @jkee9760
    @jkee9760 3 роки тому +7

    I saw your video off of a random youtube algorithm. I'm trying to get into InfoSec, where would be a good start? Also just subscribed

  • @jissjose1382
    @jissjose1382 3 роки тому

    Nice one

  • @gihandilshara847
    @gihandilshara847 3 роки тому +1

    U r great

  • @techmonster2632
    @techmonster2632 3 роки тому +1

    Plz do the same steps for sessid not json

  • @devilveyron6762
    @devilveyron6762 3 роки тому +1

    Hi sir

  • @user-if8tb9ks9n
    @user-if8tb9ks9n 3 роки тому

    How did you become aware of “Tom” the other user to insert into payload

  • @iceycoldyy7187
    @iceycoldyy7187 3 роки тому +2

    me not understanding anything

  • @andywest6062
    @andywest6062 3 роки тому

    "Checkout ANY products" is a bit of a misleading title, since all you'd need to stop this is to write good code and protect it with keys?

  • @daveayeni7114
    @daveayeni7114 2 роки тому

    Please how can I learn social engineering?? 🙏🙏🙏🙏

  • @arinzejustin2687
    @arinzejustin2687 3 роки тому +1

    I just want to be like you

  • @ckingOP
    @ckingOP 3 роки тому

    Bro please make videoon crypto orr blockchains likes that like hacking or etc

  • @vuhaidt5581
    @vuhaidt5581 3 роки тому

    The great video

  • @модернкомбат-н6г
    @модернкомбат-н6г 2 роки тому

    is it possible to bypass text captcha with such methods?

  • @unknownworldnodannalokaya1175
    @unknownworldnodannalokaya1175 3 роки тому

    Sir please tell me............can anyone do it and please tell me.........how do you get web token........I tried many times but I couldn't get a web token from more tools>>developer tools>>memory.can you give me a answer

  • @rendomanything186
    @rendomanything186 3 роки тому

    Thanks loi ❤️

  • @ahmedlol916
    @ahmedlol916 3 роки тому

    is that for carding?

  • @zionstemple
    @zionstemple 3 роки тому +2

    Lol i love how these video start out only do this in your own environment. If you dont know that maybe cybersecurity isnt for you.

    • @robbzooi
      @robbzooi 3 роки тому +2

      Everybody knows that, it's just there as a precaution to be able to deny liability

  • @babashehumodu1463
    @babashehumodu1463 2 роки тому

    Sir trying to do but proxy extension is not work please sir direct me thank you 🙏

  • @lue224
    @lue224 3 роки тому

    No Proxy listener is currently running is not there, i cant see it, can anyone help me?

  • @rfcode9432
    @rfcode9432 3 роки тому

    when will you be live?

  • @cl60cruzer
    @cl60cruzer 3 роки тому

    Its a conceptual vulnerability. Theres nothing like this in the wild and if it is its getting patched.

  • @rafsanzami7792
    @rafsanzami7792 3 роки тому +2

    invalid Access Token: signing method (alg) is unavailable. (Give a solution on it)

    • @Kitulous
      @Kitulous 3 роки тому

      did you spell the "alg": "None" part correctly?

    • @rafsanzami7792
      @rafsanzami7792 3 роки тому

      yes, i did

    • @WrittenInFilm
      @WrittenInFilm 3 роки тому

      The server configuration you have isn’t allowing you to just set the signing algorithm to what ever you want, this guy is making up scenarios that would never exist in the real world.

  • @qualitycontent5750
    @qualitycontent5750 3 роки тому

    Dude your the man

  • @Peaker20
    @Peaker20 2 роки тому +2

    Is that actually work, if i tried to do that on discord?! (To be the owner)

  • @nogit387
    @nogit387 3 роки тому

    I don't get it, what about the secret code? Is it useless to use it then? Or that application did not use a 256-bit-secret?

    • @mind.journey
      @mind.journey 3 роки тому

      By setting the algorithm to "none", the hash function used to sign the JWT on the backend returned an empty string (or null). That's why he just had a . at the end of the JWT, the signature is just missing

  • @lancemarchetti8673
    @lancemarchetti8673 3 роки тому

    Nice!

  • @ihlbit1
    @ihlbit1 3 роки тому

    If you do this and get caught you're going to jail, and it's likely not going to work many places. But hey, what do I know

  • @shivachauhan007
    @shivachauhan007 3 роки тому

    In the last when it was written that you have successfully completed the assignment. Does it means that you have ordered that with others ID???

    • @mandar3813
      @mandar3813 3 роки тому

      yes

    • @shivachauhan007
      @shivachauhan007 3 роки тому

      @@mandar3813 the order will come in our address 😂😂

    • @mandar3813
      @mandar3813 3 роки тому

      @@shivachauhan007 hopefully it will 😂😂😂

    • @MayankY2K
      @MayankY2K 3 роки тому

      @@shivachauhan007 if you receive the product, let me know too.

  • @oddly.satisfying294
    @oddly.satisfying294 3 роки тому

    Works on Amazon page?

  • @bennysepp8412
    @bennysepp8412 3 роки тому +2

    Nice =D

  • @ianxiao5543
    @ianxiao5543 3 роки тому

    Maybe useful for carding

  • @giladbaruchian7522
    @giladbaruchian7522 3 роки тому

    this is cute but totally unrealistic, in real life token consists of a password as well.

  • @kareemassi5846
    @kareemassi5846 3 роки тому

    What the meaning of json web

  • @veee330
    @veee330 3 роки тому +1

    Thanks for my new iphone 13 pro max 🙏

    • @honsol1120
      @honsol1120 3 роки тому

      Its really worked🙄

    • @veee330
      @veee330 3 роки тому

      @@honsol1120 I know that bro , just kidding 😂

    • @honsol1120
      @honsol1120 3 роки тому

      @@veee330 😂

  • @wiz2387
    @wiz2387 3 роки тому

    Hikaro

  • @aaravinthan001
    @aaravinthan001 3 роки тому

    Sir can u tell me plz how to access the web goat

  • @irishgamer780
    @irishgamer780 3 роки тому

    i need your help with somthing ?

  • @alangeorge4923
    @alangeorge4923 3 роки тому

    Mr loi ,I installed an app which I think is from a hacker and im pretty sure that he was trying meta exploit ,anyways I deleted the app, am I safe ? Should I be concerned ?

    • @alangeorge4923
      @alangeorge4923 3 роки тому

      @joe biden fan 12 yes,sir I did ,
      would that be anykind of threat to me ?

    • @shortsbymoiz9727
      @shortsbymoiz9727 3 роки тому

      @@alangeorge4923 you have to delete its all files from any archiver you got.

  • @GUnitSoldier4
    @GUnitSoldier4 3 роки тому

    If you do this on your own pace, how fast can you achieve this? because doing it at this pace it looks utterly slow and long to do so XD

  • @harishwadreddy
    @harishwadreddy 3 роки тому +1

    I will make u pay 😂😂 jk mate u doing great

  • @Soleusgaming
    @Soleusgaming 3 роки тому +1

    Lol 😂😂 but it wont work on present websites... Because devlopers are our grandfathers in these

  • @1fnergunerug
    @1fnergunerug 3 роки тому

    Hello

  • @orlem5837
    @orlem5837 3 роки тому +1

    well, if someone created a service and/or environment allowing 'None' as the JWT algorithm they are idiots.

    • @rockokechukwu3343
      @rockokechukwu3343 3 роки тому

      Or even worse if they don't check for algorithm at all. I know of someone who did such a mistake and refuse to take responsibility

  • @mr-sol7605
    @mr-sol7605 3 роки тому

    Sir I need your help

  • @matrixlife
    @matrixlife Рік тому

    Sir I couldn't activate my account in a website. Please help me to activate this account so that I can get paid my salary

  • @kumarsunny123
    @kumarsunny123 3 роки тому

    same video again?