LEARNING PATH: Advanced Application Security

JWT Jiu-Jitsu

For any modern web application, authentication and authorization are key components of the security posture. In recent years, JSON Web Token (JWT) has become one of the leading technology standards used to secure and protect web apps of all kinds. Loved by many but hated by cryptographers, JWT is used extensively in OAuth, OIDC, Kubernetes, and other distributed web services and microservices.

In this course, we’ll be learning about JSON Web Token with a focus on attacking vulnerable JWT implementations and looking at defense strategies. We start with an introduction to JWT and why we need it. We’ll also explore the essentials of JWTs with cryptography.

Most of our time will be spent taking a deep-dive into attacking JWTs. This includes JWT algorithm confusion, authentication bypass, mutable claims attack, and HMAC brute force attacks, among others. Every single one of our lessons will be taught with the help of lab exercises to give you a hands-on look at real-world methods used to attack JSON Web Tokens.

All of AppSecEngineer’s video lessons and labs have been carefully crafted to deliver high-quality training while helping you retain as much of it as possible. All our material is designed to deliver real-world problem-solving experience. When you finish this course, you’ll be able to directly apply what you’ve learned to secure web apps with JWT.

Proficiency Intermediate

Audience Cloud Security Expert

Course Duration 3

Lessons 11

Cloud Labs 4

Courses Labs

An Intro to JWT
- The need for JWT
- JWT Standards
- The Anatomy of a JWT
- Who uses JWT?
JWT Crypto Essentials
- HMAC JWTs
- JWTs with Public Key Cryptography
Attacking JWTs - An Overview
- Intro to JWT vulnerabilities
- JWT Library Foot-Guns
Attacking JWTs
- JWT Algo Confusion – Lab
- JWT Algo Confusion
- JKU Authentication Bypass – Lab
- JWT Mutable Claims Attack – Lab
- JWT Mutable Claims
- JWT HMAC Bruteforce – Lab
- JWT HMAC Bruteforce