Lesson pack 6 · Core · 120 minutes
Web attacks and session tokens
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 6 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Decode a JWT and identify the attack its header enables
- Forge an alg=none token and recover a weak HMAC secret offline
- Discover unlinked content, including exposed .git directories
- Choose a detection probe for SQL injection, SSTI, and command injection, and read the response for confirmation
Running order (120 min)
| Time | What happens |
|---|---|
| 0:00-0:12 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:12-0:36 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:36-1:06 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 1:06-1:48 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:48-2:00 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- JWT decoder and signature verifier - Decode a JSON Web Token’s header and payload and verify HS256/HS384/HS512 signatures against a known secret - all locally.https://ctfpal.com/?tool=jwt-decoder
- JWT alg=none bypass generator - Forge an unsigned JWT by setting the algorithm to none, and understand why some libraries still accept it.https://ctfpal.com/?tool=jwt-none-algorithm
- JWT secret brute force - Recover a weak HMAC signing secret from a JWT by testing a wordlist against the token’s own signature, in the browser.https://ctfpal.com/?tool=jwt-secret-bruteforce
- Directory and path scanner - Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.https://ctfpal.com/?tool=directory-scanner
- Exposed .git directory dumper - Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.https://ctfpal.com/?tool=git-leak-dumper
- Web attack payload catalog - Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.https://ctfpal.com/?tool=payload-catalog
Reading
- Attacking JWTs: alg=none, algorithm confusion, and the header fields nobody audits - 6 min. A JSON Web Token is a signed claim you were handed and asked to give back. Every classic JWT bug is a place where the verifier lets the token choose how it is verified - alg=none, RS256 to HS256 confusion, kid injection, and attacker-hosted key URLs.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Blame Game - picoCTF 2024, easy
- Collaborative Development - picoCTF 2024, easy
- Commitment Issues - picoCTF 2024, easy
- Cookie Monster Secret Recipe - picoCTF 2025, easy
- Cookies - picoCTF 2021, easy
- Crack the Gate 1 - picoMini by CMU-Africa, easy
- logon - picoCTF 2019, easy
- MY GIT - picoCTF 2026, easy
- Old Sessions - picoCTF 2026, easy
- Time Machine - picoCTF 2024, easy
- Apriti sesamo - picoCTF 2025, medium
- byp4ss3d - picoMini by CMU-Africa, medium
Checkpoint (gradeable)
Take a JWT-protected endpoint and reach an admin-only response, stating which of the three token weaknesses you used and why the other two did not apply.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
This is the first module with real-world legal weight. Cover authorisation explicitly before the tools: the same techniques against a system nobody gave you permission to test are a criminal offence, not a lesson.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.