What's this eyJ Token? | JWT Breakdown Part 1

Hacking JWTs! Portswigger Web Security Academy JWT authentication bypass via unverified signature - https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature

▹ SKIP TO LAB - 5:12

▹ Watch me Live on Twitch - https://twitch.tv/garr_7
▹ Shoutout to Shikairi for the Editing! - https://twitter.com/_shikairi

#JWThacking #hacker #bugbounty #website

▹ Additional References for Further Exploration:

Fireship Session vs Token Authentication - https://www.youtube.com/watch?v=UBUNrFtufWo
JWT Parkour by Louis from PentesterLab - https://www.youtube.com/watch?v=zWVRHK3ykfo
JWT RFC - https://datatracker.ietf.org/doc/html/rfc7519

------------------------------------------------------------------------------
In this series, we take a look at Web Security Academy's JWT Labs and break them down. The goal is to break down the concepts to not only get to the solution, but talk about methodology and the mental steps we take in order to discover these vulnerabilities in the wild.

Timestamps:
0:00​ New to hacking? What's eyJ all about?
0:28​ What is a JWT?
1:47 Components of a JWT
3:35 Why even use a JWT over traditional, Cookie-based auth?
4:30 Where do issues arise with JWTs?
5:12 JWT Methodology and Lab START
9:51 Recap on JWTs
6:07 Outro