Webeasy

Trust Nothing Signed Badly

150 points · 0 solved

A session token fell into your lap. JWTs are signed, not encrypted — decode the payload.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3RhZmYiLCJmbGFnIjoic3N7and0X2lzX3NpZ25lZF9ub3RfZW5jcnlwdGVkfSJ9.dGVzdHNpZw

The flag is in the payload claim. alg=none would be even easier — never trust a token you can't verify.

Material

Paste into jwt.io or decode the middle segment with base64url.

Hints0/2