JWT Key Confusion & Nunjucks SSTI - "Naughty or Nice" [Day 5: HackTheBox Cyber Santa CTF]

Video walkthrough for the "Naughty or Nice" Web challenge from Day 5 of the ‪@HackTheBox‬ "Cyber Santa" Capture The Flag (CTF) 2021. We'll exploit a signature confusion vulnerability for JSON Web Tokens (forging a new JWT for admin user) and leverage our new privileges to exploit a Server-Side Template Injection (SSTI) vulnerability (nunjucks), achieving Remote Code Execution (RCE). Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #HackTheBox #HTBCyberSanta21 #CaptureTheFlag #CTF Sign up for HackTheBox: https://htb-signup.cryptocat.me Write-ups: https://cryptocat.me/blog/ctf/2021/#h... ↢Hack The Box↣ https://www.hackthebox.com/events/san...   / hackthebox_eu     / discord   ↢JWT / Nunjucks SSTI↣ https://jwt.io https://github.com/ticarpi/jwt_tool http://disse.cting.org/2016/08/02/201... https://0xdf.gitlab.io/2021/11/02/htb... 👷‍♂️Resources🛠 https://cryptocat.me/resources Start: 0:00 Explore website: 0:49 Test basic SQLi/SQLMap: 1:53 Create new account: 2:57 Decode JWT cookie: 4:06 Investigate JWT vulnerabilities: 5:20 Research and install jwt_tool: 6:35 Try JWT "None" key attack: 8:00 Review source code: 11:48 Forge new JWT for Admin ("Key Confusion" attack): 16:08 Investigate Nunjucks SSTI: 18:58 Test SSTI payloads: 20:32 Use RCE to retrieve the flag: 21:39 End: 25:01