Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

JWT RS256 → HS256 algorithm confusion → admin

Server verifies any algorithm declared in the JWT header. Sign an HS256 token using the public RSA key as the HMAC secret — server accepts it as legit.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: JWT-based auth, RS256 in production, but the JWT library doesn't strictly require the algorithm — accepts whatever the header says.

§ Steps

  1. 01
    Exfil sensitive dataExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Replace token in Authorization headerLateral Movement
    T1550.003— Pass the Ticket
  3. 03
    Identify JWT-based authReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  4. 04
    Obtain the RSA public keyReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery

    Often at /.well-known/jwks.json or a cert endpoint.

  5. 05
    Forge HS256 token using public key as HMAC secretCredential Access
    W-JWT-ALG-CONFUSION— JWT — RS256 → HS256 Algorithm Confusion

    jwt_tool / jwt-cracker / by hand: change alg, sign with public key bytes.

  6. 06
    Access admin-only endpointsPrivilege Escalation
    W-BFLA— Broken Function Level Authorization (API BFLA)

§ References

§ Frequently asked

What is the "JWT RS256 → HS256 algorithm confusion → admin" attack path?
Server verifies any algorithm declared in the JWT header. Sign an HS256 token using the public RSA key as the HMAC secret — server accepts it as legit. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil sensitive data (T1041) — a exfiltration primitive. Assumed environment: JWT-based auth, RS256 in production, but the JWT library doesn't strictly require the algorithm — accepts whatever the header says.
What is the final impact of this kill-chain?
The final step lands on Access admin-only endpoints (W-BFLA), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers