Web - Server

Monday 13 March 2023, 18:22  #1
Web - Server - JWT - Unsecure Key Handling
tainnee
  • 11 posts

I thought that I was rocking this one until I figured that I’m in a localhost jail. I feel like the solution is so close that I can’t see it. Any hint on how to break out of the localhost jail ?

Monday 27 March 2023, 16:02  #2
Web - Server - JWT - Unsecure Key Handling
ebgfk4t7
  • 2 posts

Does that mean you’re hosting your own `jwks.json` somewhere? If so, note that the domain name is not necessarily the first thing after `http://` in a URL: https://en.wikipedia.org/wiki/URL

Wednesday 29 March 2023, 17:08  #3
Web - Server - JWT - Unsecure Key Handling
tainnee
  • 11 posts

Thanks ebgfk4t7. I must say that your answer is quite inspiring. Now I got a bunch of stuff to go try out. The only thing that troubles me is that you seem surprised that I’m hosting my own jwks.json. Now I feel like I missed something and that I’m over-complicating things. Where you able to complete this challenge only using local files ?

Thursday 30 March 2023, 13:30  #4
Web - Server - JWT - Unsecure Key Handling
ebgfk4t7
  • 2 posts

Oh, sorry, didn’t mean to give you that feeling. I hadn’t actually completed the challenge when I replied to you, so you in turn inspired me to dig further into hosting my own `jwks.json`

Thursday 25 May 2023, 10:42  #5
Web - Server - JWT - Unsecure Key Handling
ThePositron
  • 3 posts

Ho my god, how could I have been so dumb ... Tunnel vision drags you into rabbit holes sometimes. Thanks ebgfk4t7

Friday 7 July 2023, 14:32  #6
Web - Server - JWT - Unsecure Key Handling
0xSpectra
  • 3 posts

Hey guys, are you able to retreive the jwk.json used in the original JWT ? I understood that we need it to craft our payload.

Monday 10 July 2023, 22:27  #7
Web - Server - JWT - Unsecure Key Handling
bessantoy
  • 1 posts

hello spectra ! So did you manage to read the original jwk.json ?