WHAM Token

Challenge Description

Get the tokens controlling the bots and end this madness.

Flag: Raptor{SigNinG_T0k3Ns_N_T4kinG_N4m3S}

Enumeration

Connecting to the service:

nc 66.11.105.165 21198

1) 🔑 Get Signing Key
2) 🎟  Get Auth Token
3) 🛡  Submit Admin JWT

The menu essentially hands us the attack path. Option 1 first:

Select an option > 1

📦 Product: JWT Signing Key
WHAM_M3_via_The_Cart

Then option 2 for a token to work with:

Select an option > 2

🎟 Your WHAMazon Auth Token
eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJzdWIiOiAiMTIzNDU2Nzg5MCIsICJuYW1lIjogIkJPT00iLCAiYWRtaW4iOiBmYWxzZSwgImlhdCI6IDE1MTYyMzkwMjJ9.Uskb1HmZuLbTEfO5-qXNJdDWTk4nEnhw6lfyaDPWaZc

Token Analysis

Pasting the token into jwt.io and decoding the payload:

{
  "sub": "1234567890",
  "name": "BOOM",
  "admin": false,
  "iat": 1516239022
}

"admin": false, there's the restriction to lift. The algorithm is HS256, meaning the token is signed with a shared HMAC secret. We already have that secret: WHAM_M3_via_The_Cart.

Token Forgery

In jwt.io, with the signing key set to WHAM_M3_via_The_Cart, flip "admin": false to "admin": true in the payload editor. The tool re-signs the token automatically:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkJPT00iLCJhZG1pbiI6dHJ1ZSwiaWF0IjoxNTE2MjM5MDIyfQ.7hTszlNIm98SmOTf6Y6BW8TJNGgiAGItB264vOqUp08

Exploitation

Submit the forged token via option 3:

Select an option > 3

🛡 Submit your JWT for validation
[paste token]

✅ ADMIN ACCESS GRANTED

Admin console unlocked. Isolating the bot swarm:

Select an option > 1
🔄 Swarm state changed to ISOLATED

Select an option > 2
🐝 Swarm fully isolated
Raptor{SigNinG_T0k3Ns_N_T4kinG_N4m3S}

Why This Works

JWT security depends entirely on the secrecy of the signing key. A validly-signed token with "admin": true is indistinguishable from a legitimately issued one, the server verifies the signature, it checks out, and it trusts the claims inside.

Exposing the signing key via an unauthenticated API endpoint (option 1) is the entire vulnerability here. It doesn't matter how strong WHAM_M3_via_The_Cart is as a secret if you hand it out to anyone who connects. With the key, any claim in the token can be forged with a valid signature.

Key Takeaways

JWT signing keys must be secret. Exposing them, even in a "internal" or "diagnostic" context, completely undermines the token's security guarantees. Anyone with the key can forge tokens claiming any identity or privilege level they want.

For CTF purposes: when a JWT challenge gives you the signing key, the attack is always "modify the payload, re-sign, submit." jwt.io handles the mechanics. The interesting part is always how the key was exposed.