Class: Msf::Exploit::Remote::HTTP::JWT

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/exploit/remote/http/jwt.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(payload:, header:, signature:) ⇒ JWT

Returns a new instance of JWT.



12
13
14
15
16
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 12

def initialize(payload:, header:, signature:)
  @payload = payload
  @header = header
  @signature = signature
end

Instance Attribute Details

#header ⇒ Object (readonly)

Returns the value of attribute header.



10
11
12
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 10

def header
  @header
end

#payload ⇒ Object (readonly)

Returns the value of attribute payload.



10
11
12
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 10

def payload
  @payload
end

#signature ⇒ Object (readonly)

Returns the value of attribute signature.



10
11
12
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 10

def signature
  @signature
end

Class Method Details

.base64_url(data) ⇒ Object 



18
19
20
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 18

def self.base64_url(data)
  Base64.urlsafe_encode64(data).gsub('=', '')
end

.decode(jwt, _key = nil, _verify = true, _options = {}) ⇒ Object

Raises:

  • (ArgumentError) 


37
38
39
40
41
42
43
44
45
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 37

def self.decode(jwt, _key = nil, _verify = true, _options = {})
  header, payload, signature = jwt.split('.', 3)
  raise ArgumentError, 'Invalid JWT format' if header.nil? || payload.nil? || signature.nil?

  header = JSON.parse(Rex::Text.decode_base64(header))
  payload = JSON.parse(Rex::Text.decode_base64(payload))

  new(payload: payload, header: header, signature: signature)
end

.encode(payload, key, algorithm = 'HS256', header_fields = {}) ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/msf/core/exploit/remote/http/jwt.rb', line 22

def self.encode(payload, key, algorithm = 'HS256', header_fields = {})
  header = base64_url(%({"alg":"#{algorithm}","typ":"JWT"}))

  payload = base64_url(payload)

  case algorithm
  when 'HS256'
    signature = base64_url(OpenSSL::HMAC.digest('SHA256', key, "#{header}.#{payload}"))
  else
    raise NotImplementedError, "#{algorithm} currently not supported"
  end

  "#{header}.#{payload}.#{signature}"
end