[hellooword]

maybe i can trade this web (Intergalactic Bounty) for the first two web or any FullPwn

- direct message

[wintercaptainsoldier]

maybe i can trade this web (Intergalactic Bounty) for the first two web or any FullPwn

- direct message

Hey I can trade apolo or armaxis for the Intergalactic Bounty

[Surfacing2325]

hello. i have Armaxis and Breaking Bank

[hellooword]

maybe i can trade this web (Intergalactic Bounty) for the first two web or any FullPwn

- direct message

Hey I can trade apolo or armaxis for the Intergalactic Bounty

send private message Intergalactic Bounty solution i can give both apolo and armaxis

[wintercaptainsoldier]

hello. i have Armaxis and Breaking Bank

Can you give me a hint for breaking bank ?

[Surfacing2325]

hello. i have Armaxis and Breaking Bank

Can you give me a hint for breaking bank ?

yeep

For "Breaking Bank," here's a useful hint:

• Focus on JWT verification: The server validates JWT tokens by fetching the JSON Web Key Set (JWKS) from a URL specified in the 
  jku
   claim of the token header.
  
• What to exploit:
  
  • There might be insufficient validation on the 
    jku
     claim.
    
  • If you control the URL or can redirect the server to your JWKS file, you can craft a JWT signed with your private key.
    
• Steps to think about:
  
  
  1. Forge a JWT with a 
     jku
      header pointing to your server (hosting a JWKS file).
     
  2. Ensure the JWKS file contains the public key matching the private key you used to sign the JWT.
     
  3. Trick the server into using your JWKS file to validate the token.
     
  4. Access privileged endpoints or accounts (e.g., 
     financial-controller@frontier-board.htb).
     

[wintercaptainsoldier]

hello. i have Armaxis and Breaking Bank

Can you give me a hint for breaking bank ?

yeep

For "Breaking Bank," here's a useful hint:

• Focus on JWT verification: The server validates JWT tokens by fetching the JSON Web Key Set (JWKS) from a URL specified in the 
  jku
   claim of the token header.
  
• What to exploit:
  
  • There might be insufficient validation on the 
    jku
     claim.
    
  • If you control the URL or can redirect the server to your JWKS file, you can craft a JWT signed with your private key.
    
• Steps to think about:
  
  
  1. Forge a JWT with a 
     jku
      header pointing to your server (hosting a JWKS file).
     
  2. Ensure the JWKS file contains the public key matching the private key you used to sign the JWT.
     
  3. Trick the server into using your JWKS file to validate the token.
     
  4. Access privileged endpoints or accounts (e.g., 
     financial-controller@frontier-board.htb).
     

Yes I tried to do something like jku: http://127.0.0.1:1337/analytics/redirect?url=webhook, where I had my own pub key. But I never saw a request in the webhook. Did you store the pub key somewhere else ?

[Surfacing2325]

hello. i have Armaxis and Breaking Bank

Can you give me a hint for breaking bank ?

yeep

For "Breaking Bank," here's a useful hint:

• Focus on JWT verification: The server validates JWT tokens by fetching the JSON Web Key Set (JWKS) from a URL specified in the 
  jku
   claim of the token header.
  
• What to exploit:
  
  • There might be insufficient validation on the 
    jku
     claim.
    
  • If you control the URL or can redirect the server to your JWKS file, you can craft a JWT signed with your private key.
    
• Steps to think about:
  
  
  1. Forge a JWT with a 
     jku
      header pointing to your server (hosting a JWKS file).
     
  2. Ensure the JWKS file contains the public key matching the private key you used to sign the JWT.
     
  3. Trick the server into using your JWKS file to validate the token.
     
  4. Access privileged endpoints or accounts (e.g., 
     financial-controller@frontier-board.htb).
     

Yes I tried to do something like jku: http://127.0.0.1:1337/analytics/redirect?url=webhook, where I had my own pub key. But I never saw a request in the webhook. Did you store the pub key somewhere else ?

Write pm

[wintercaptainsoldier]

hello. i have Armaxis and Breaking Bank

Can you give me a hint for breaking bank ?

yeep

For "Breaking Bank," here's a useful hint:

• Focus on JWT verification: The server validates JWT tokens by fetching the JSON Web Key Set (JWKS) from a URL specified in the 
  jku
   claim of the token header.
  
• What to exploit:
  
  • There might be insufficient validation on the 
    jku
     claim.
    
  • If you control the URL or can redirect the server to your JWKS file, you can craft a JWT signed with your private key.
    
• Steps to think about:
  
  
  1. Forge a JWT with a 
     jku
      header pointing to your server (hosting a JWKS file).
     
  2. Ensure the JWKS file contains the public key matching the private key you used to sign the JWT.
     
  3. Trick the server into using your JWKS file to validate the token.
     
  4. Access privileged endpoints or accounts (e.g., 
     financial-controller@frontier-board.htb).
     

Yes I tried to do something like jku: http://127.0.0.1:1337/analytics/redirect?url=webhook, where I had my own pub key. But I never saw a request in the webhook. Did you store the pub key somewhere else ?

Write pm

I can't . You have disabled private messages. Can you pm me ?

[eunaosei]

yeep

For "Breaking Bank," here's a useful hint:

• Focus on JWT verification: The server validates JWT tokens by fetching the JSON Web Key Set (JWKS) from a URL specified in the 
  jku
   claim of the token header.
  
• What to exploit:
  
  • There might be insufficient validation on the 
    jku
     claim.
    
  • If you control the URL or can redirect the server to your JWKS file, you can craft a JWT signed with your private key.
    
• Steps to think about:
  
  
  1. Forge a JWT with a 
     jku
      header pointing to your server (hosting a JWKS file).
     
  2. Ensure the JWKS file contains the public key matching the private key you used to sign the JWT.
     
  3. Trick the server into using your JWKS file to validate the token.
     
  4. Access privileged endpoints or accounts (e.g., 
     financial-controller@frontier-board.htb).
     

Yes I tried to do something like jku: http://127.0.0.1:1337/analytics/redirect?url=webhook, where I had my own pub key. But I never saw a request in the webhook. Did you store the pub key somewhere else ?

Write pm

I can't . You have disabled private messages. Can you pm me ?

im writing

can you pm me too?