CTF Writeup: JWT 'alg:none' Flaw Exploited to Gain Admin Access in NexaVault

·3 views

A Capture The Flag (CTF) challenge called 'The Vault Door' featured NexaVault, a mock web app that restricted an Admin Vault panel using role claims stored in a JWT cookie. The app failed to enforce a fixed signing algorithm server-side, instead trusting the 'alg' field supplied within the attacker-controlled token header. By forging a new JWT with the algorithm set to 'none' and the role changed to 'admin', a participant bypassed authentication without needing the server's secret key. The server accepted the unsigned token and granted full admin access, revealing the CTF flag. This exploit illustrates the classic CWE-347 JWT algorithm confusion vulnerability, where developers must hardcode the expected algorithm rather than deriving it from the token itself.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Layer-by-Layer AI Auditing: Why Spot Checks Leave Dangerous Gaps

Shipping AI systems reliably requires systematic, layer-by-layer auditing rather than quick spot checks, which tend to miss edge cases and multi-step failure points. A thorough audit covers every layer — data pipeline, model behavior, agent decision-making, downstream effects, and rollback paths — documenting potential failures before they reach production. Skipping even one layer creates a vulnerability that production traffic will eventually expose, often triggering cascading issues that are far costlier to fix. The recommended approach is to build a comprehensive audit checklist, assign it to a methodical reviewer with adequate time, and update it continuously as new issues emerge. Over time, this checklist becomes institutional knowledge capturing what genuinely matters for a given AI system's domain.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

The simple bitrate math that lets ffmpeg hit an exact target file size

A developer on DEV Community has outlined a straightforward arithmetic method to compress video files to a precise size limit using ffmpeg, eliminating the need for repeated trial-and-error exports. The core formula treats file size as bitrate multiplied by duration, then works backwards: given a known duration and a target size, the required bitrate becomes a single division. The process accounts for real-world factors such as container overhead (roughly 2%) and a fixed audio bitrate, with the remainder allocated to video. The author implemented this logic in a Rust command-line tool called DeepShrink, but emphasizes that the underlying math is the key insight. The approach is particularly useful when uploading to platforms like Discord or bug trackers that enforce strict file size limits.

0 comments Read more at DEV Community

ProgrammingHacker News ·

New Tool Sends Alerts for Premium Seats at 70mm IMAX Screenings of The Odyssey

A developer has launched a web tool called Imaxxing that notifies users when good seats become available at 70mm IMAX screenings of Christopher Nolan's upcoming film The Odyssey. The service targets moviegoers who want the best possible viewing experience at premium large-format theaters. Users can sign up to receive alerts rather than manually checking for seat availability. The tool was shared on Hacker News, where it garnered modest early attention from the community.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How WebSockets and Redis Work Together to Power Scalable Real-Time Apps

Modern web applications increasingly demand real-time features like live dashboards, instant messaging, and collaborative editing, creating complex engineering challenges around scalability and fault tolerance. WebSockets address these needs by enabling persistent, full-duplex communication between clients and servers, eliminating the inefficiencies of traditional HTTP's request-response model. However, WebSockets alone cannot manage state across multiple server instances or handle horizontal scaling effectively. Redis complements WebSockets by acting as a message broker and data store, with its Pub/Sub feature allowing multiple WebSocket servers to share messages without direct knowledge of each other. Together, the two technologies form a resilient architecture where Redis handles state management and inter-server communication while WebSockets maintain low-latency client connections.

0 comments Read more at DEV Community