[macavitysworld]

HTB Web Challenge - Insomnia(Quick writeup)

• Interception of the login request and deletion of the password parameter.
  
• Entered an existing username in the DB (e.g., "test") to receive the JWT token.
  
• Sent the JWT token to /index.php/profile endpoint with the username changed to "administrator" to obtain the flag.
  

Flag

Hidden Content

You must register or login to view this content.

[Xerion]

Wow this is very helpful

[Art10n]

how can I change the JWT? I have not the JWT_SECRET and the JWT became invalid!

[TREXNEGRO]

Thanks friend, I'll see... keep it up my king...

[macavitysworld]

how can I change the JWT? I have not the JWT_SECRET and the JWT became invalid!

- Intercept the request
- sent to repeater
- Delete password parameter
- add user as administrator
- you'll get the required token