So it looks like that unlike the encode method which uses default algorithm set to HS256, the decode method defaults to the algorithm specified in the JWT header, which we have complete control of - classic arbitrage. This means that if we do not happen to explicitly specify the algorithm when we call the decode function, we will end up verifying the token with the algorithm specified by the attacker. As it turns out our service does exactly this - I told you it is way too convenient.
So up to this point all we know is that the attacker with the hoodie controls the signing algorithm that is used to verify the signature of the token. But earlier on we forged our own token using the HMAC algorithm and that did not work.
Clearly the header contains HS256 which the jwt-simple library will use because the developer did not provide their own defaults. However, notice that when we generated the token using HS256 we also used arbitrary signing key with the value secret. Of course this is not going to work because the decode method does not have the same key and there is no way we can force-feed it.
However, if the verification algorithm is HS256 than what is the key? Clearly, in our example the key is the public key as you would expect if we are using the RS256: private key signs - public key verifies. Aha! So in fact, when we forge our own token with HS256, the secret key for the verification method is nothing else but the public key which as you can imagine is - public!
However, if the verification algorithm is HS256 than what is the key? Clearly, in our example the key is the public key as you would expect if we are using the RS256: private key signs - public key verifies. Aha! So in fact, when we forge our own token with HS256, the secret key for the verification method is nothing else but the public key which as you can imagine is - public!
Equipped with this awesome information let's try again but this time when we forge the token we will use the public key instead of the arbitrary string we used earlier. We can retrieve the public key from /key.pem.
If you just copy and paste the key into the token parameter that has the JWT generator, it may not work. The reason for this is because both strings need to be exact in order for the HS256 to work. Spaces, line-endings and all kinds of other characters that you may not visually see, or be able to copy with CTRL+C, are required for this to work. It needs to be 1-to-1. This is where we will use our file retriever to make this perfect.
Voila! Magic happened. We managed to forge our own token using a simple trick on a conveniently vulnerable API.
βPornHubβ ββ[ABH! CRACKER]ββ.ini.sccfg
5.7 KB
π₯ PornHub π₯
[ Storm Config ]
π β’ Proxy => FreshPublic
π β’ Threads => 150-180
π β’ Capture => Yes
=====================
π₯π₯π₯π₯π₯π₯π₯π₯
FASTEST ON TG ACCORDING TO ME And Stable One
π₯π₯π₯π₯π₯π₯π₯π₯
=====================
πβ’ Use Good Combos
πβ’ Fresh Proxies
πβ’ For Better Performance Use Rdp
βοΈ Config Developed By=> Abh! Cracker π₯π₯π₯π₯π₯π₯
[ Storm Config ]
π β’ Proxy => FreshPublic
π β’ Threads => 150-180
π β’ Capture => Yes
=====================
π₯π₯π₯π₯π₯π₯π₯π₯
FASTEST ON TG ACCORDING TO ME And Stable One
π₯π₯π₯π₯π₯π₯π₯π₯
=====================
πβ’ Use Good Combos
πβ’ Fresh Proxies
πβ’ For Better Performance Use Rdp
βοΈ Config Developed By=> Abh! Cracker π₯π₯π₯π₯π₯π₯
βAmazon_in{EMI_AND_PAY_BALANCE}βββAbh!.sccfg
7.8 KB
π₯ AMAZON.IN π₯
[ Storm Config ]
#1st_Time_On_Telegram
#Without_Hit_Stealer
π β’ Proxy => FreshPublic/SEMI-HQ
π β’ Threads => 150-180
π β’ Capture => Yes
=====================
π₯π₯π₯π₯π₯π₯π₯π₯
FASTEST ON TG ACCORDING TO ME And Stable One
π₯π₯π₯π₯π₯π₯π₯π₯
Capture Format β€οΈ
=====================
Account: xxxxxx@xxx.xx:Xxxx | EMI Balance: NO/Yes | Pay Balance: βΉ xxx | Config By One and Only =[==> Abh! Cracker<==]=
=====================
πβ’ Use Good INDIAN Combos
πβ’ Semi-Hq (Recommended)
πβ’ For Better Performance Use Rdp
βοΈ Config Developed By=> Abh! Cracker π₯π₯π₯π₯π₯π₯
One Nigga Mf Asshole Is selling This Type Config
U Guys know who is that
And Stealing Hits Also π€£π€£
ππππ€£π€£π€£
[ Storm Config ]
#1st_Time_On_Telegram
#Without_Hit_Stealer
π β’ Proxy => FreshPublic/SEMI-HQ
π β’ Threads => 150-180
π β’ Capture => Yes
=====================
π₯π₯π₯π₯π₯π₯π₯π₯
FASTEST ON TG ACCORDING TO ME And Stable One
π₯π₯π₯π₯π₯π₯π₯π₯
Capture Format β€οΈ
=====================
Account: xxxxxx@xxx.xx:Xxxx | EMI Balance: NO/Yes | Pay Balance: βΉ xxx | Config By One and Only =[==> Abh! Cracker<==]=
=====================
πβ’ Use Good INDIAN Combos
πβ’ Semi-Hq (Recommended)
πβ’ For Better Performance Use Rdp
βοΈ Config Developed By=> Abh! Cracker π₯π₯π₯π₯π₯π₯
One Nigga Mf Asshole Is selling This Type Config
U Guys know who is that
And Stealing Hits Also π€£π€£
ππππ€£π€£π€£
Storm Config Decryptor By Crank 1.2].exe
508 KB
π°Strom configuration decrypter tool π°
1st On Telegram
How to dec
(If unable to download this tool then use megalink for download- "click here for link"
1st On Telegram
How to dec
rypt config file
β’Download config file then put that file on desktop
β’Run this tool small dialog box appears
β’Drag the config file inside the tool and it's done!(If unable to download this tool then use megalink for download- "click here for link"
Forwarded from Config's By MrPerfect2020
This media is not supported in your browser
VIEW IN TELEGRAM