Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Web-16. Weak JWT Secret in the CHIMERA Research Lab
Mission
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It authenticates users with JWTs, and the signing secret is suspected to be weak and guessable.
Not started
Hints
Hint 1Show
A JWT has three parts: Header, Payload, Signature — decode it at jwt.io
Hint 2Show
The signature uses a secret key. Weak keys (secret, password, 123456, etc.) can be guessed or cracked
Hint 3Show
Once you know the secret, you can modify the role in the payload and re-sign the token