ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Crypto Failures / The Unsigned Signature

The Unsigned Signature

Medium 30 pts

An API accepts this JWT and reads the algorithm out of the token's own header. The header says none — the server is verifying nothing. Decode the token to see the identity it grants; the payload carries the flag. (In a live target you would forge this yourself; here you read the forged one.)

Hints

Open them in order. They nudge, they do not solve.

Hint 1

A JWT is three base64url sections split by dots. The middle one is the payload.

Hint 2

Decode the header first to confirm alg is none — no signature is being checked.

Hint 3

Decode the payload; the flag field is the answer.

The artifact

Authorization: Bearer <token>

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4iLCJmbGFnIjoibm17YWxnX25vbmVfaXNfbm90X2Ffc2lnbmF0dXJlfSJ9.

Note the trailing dot: the third section (the signature) is empty. Split on ".", base64url-decode each part.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.