← All labs
Modern Level 5 / 8 Hard

JWT — alg Confusion

The session is a JWT. Forge an admin token.

Session inspector

Your session is carried in a JSON Web Token. Present a token below and the server validates it, then shows who it thinks you are. Become admin.

Your current session token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoieW91Iiwicm9sZSI6InVzZXIifQ.0E2cqOIHUaXjHeE2uWJXJhpulH2NerwRSiNX6rfJRkM

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.