Web attacks and session tokens
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
By the end you can
- Decode a JWT and identify the attack its header enables
- Forge an alg=none token and recover a weak HMAC secret offline
- Discover unlinked content, including exposed .git directories
- Choose a detection probe for SQL injection, SSTI, and command injection, and read the response for confirmation
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
JWT decoder and signature verifier
Decode a JSON Web Token’s header and payload and verify HS256/HS384/HS512 signatures against a known secret - all locally.
JWT alg=none bypass generator
Forge an unsigned JWT by setting the algorithm to none, and understand why some libraries still accept it.
JWT secret brute force
Recover a weak HMAC signing secret from a JWT by testing a wordlist against the token’s own signature, in the browser.
Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
Exposed .git directory dumper
Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.
Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 36 match in total - see the full index.
Checkpoint
Take a JWT-protected endpoint and reach an admin-only response, stating which of the three token weaknesses you used and why the other two did not apply.
Teaching note
This is the first module with real-world legal weight. Cover authorisation explicitly before the tools: the same techniques against a system nobody gave you permission to test are a criminal offence, not a lesson.