"We sniffed a session token off NexusVault's staff portal. It's just a guest account — but their auth is JWT, and rumour says an intern picked the signing secret. Get us an admin session and pull the vault flag. Everything verifies right here in your browser, Agent."
Your goal: turn the intercepted guest token into a valid admin token that the Vault console below will accept.
A live guest session token, signed with HS256:
Paste a forged token below. The console verifies the HS256 signature and checks the role — an admin session unlocks the flag.
You'll want to decode, crack, and re-sign JWTs offline. These help:
Stuck? Open a hint. Each reveals a little more.
header.payload.signature, each part base64url. Most people only decode the payload and see "role":"guest". Decode the header too — this vault put something unusual in it. Whatever you find there may itself be encoded again.HS256 — symmetric, so the signature is only as strong as the secret. The intern chose a weak, guessable password. Recover it with an offline dictionary attack against the intercepted token. But note: cracking the secret and setting role:admin alone will not open the vault…kid reveals a second claim the scoped console demands (decode it, then decode its inner value). Use JWTweak: Crack HMAC secret with rockyou.txt, then forge a token that sets both role=admin and the required clearance claim, re-signed with the cracked secret. Paste it into the console.