Lion Cipher Lab
Forge a JWT with an algorithm-confusion attack (RS256 to HS256)
- AppSec / DevSecOps
- Advanced
- ~60 min
- Free · no account required
Why it matters
A JWT is the little signed token that says 'this is who the user is' on countless APIs and single-page apps. If the code that CHECKS the token trusts the token to name its own signing algorithm, an attacker can rewrite the token to say 'I am admin' and re-sign it with a key everyone already has. Algorithm confusion is one of the most common critical JWT flaws, and once you've forged one by hand you will never again write a verifier that trusts the header.
What you'll learn
- JWT structure and signing (RS256 vs HS256)
- The algorithm-confusion attack and why it works
- Reading and forging JWT headers and claims
- Pinning a verification algorithm allowlist
- JWT best current practice (RFC 8725)
Steps in this lab
- What a JWT is, in one breath
- Set up a clean workspace
- Generate the server's RSA keypair
- Mint a legitimate RS256 token
- Build the vulnerable verifier (the real bug pattern)
- Forge an admin token with the public key
- Land the attack
- Fix it: pin the algorithm allowlist
- When it bites, and how a pro shuts the door