> For the complete documentation index, see [llms.txt](https://x7331.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://x7331.gitbook.io/notes/postswigger/jwt-attacks/attacks/algorithm-confusion.md).
# Algorithm Confusion
> **Algorithm Confusion Attack**: using an unexpected algorithm to sign the token.
## Symmetric vs Asymmetric Algorithms
* **Symmetric algorithms** use the **same key** to both sign and verify the token, whereas **asymmetric algorithms** use a **key pair**, i.e., a private key to sign the token and a public key to verify it.
* Vulnerabilities arise due to flawed implementation of JWT libraries.
## Process
1. Obtain the server's public key.
* This might be done through conventional endpoints such as `/jwks.json` or `/well-known/jwks.json`.
2. Convert it to a suitable format.
* The exposed keys (JWK format) must be identical with the server's keys.
3. Create a malicious JWT with a modified payload and the `alg` set to `HS256`.
4. Sign the token with `HS256` using the public key as the secret.
### LAB: Algorithm Confusion
> **Goal**: Obtain the key via a standard endpoint, use it to sign a modified session token to access `/admin` and delete `carlos`. The server stores the key in a `X.509` PEM file.
## Deriving Public Keys from Existing Tokens
If no exposed public keys are available, we can derive one from a pair of existing JWTs using [`jwt_forgery.py`](https://github.com/silentsignal/rsa_sign2n).
```bash
# Simplified version of the above tool
docker run --rm -it portswigger/sig2n
```
The above command is using the provided token to calculate one or more potential `n` values. For each potential value, the script outputs:
1. A base64-encoded PEM key in both `X.509` and `PKCS1` format.
2. A forged JWT signed using each of these keys.
To identify the correct key we need to try both and see which is accepted by the server.
### LAB: Algorithm Confusion With Forged Key
> **Goal**: Obtain the key via a standard endpoint, use it to sign a modified session token to access `/admin` and delete `carlos`. The server stores the key in a `X.509` PEM file.
{% code overflow="wrap" %}
```bash
$ docker run --rm -it portswigger/sig2n eyJ...jMQ eyJ......dQb
```
{% endcode %}
