Unable to sign JWT after creating symmetric key #19
Comments
|
Just to clarify, the issue is with the 'ok' button on the final signing screen only. I tried to switch between radio buttons and see but noticed that the selection on 'Don't modify header' is just disappearing without any further changes. It just hangs there unless I click cancel. |
|
Hi @prasgop @i've not managed to reproduce your issue with the symmetric key 'AA=='. This should be padded with null bytes before signing to work around a length constraint. It sounds like an exception is being thrown during the signing operation. Do you see anything logged out if you start Burp manually from a console? |
|
Thanks for the quick response. |
|
Just a quick update - Thanks |
|
The extension pads symmetric keys less than 64 bytes so your key should work fine. If you can reproduce the issue on your host machine then there may be something useful logged to the console. |
|
Can you please tell me where should I check for that log? Thanks |
|
Sure. You can get Burp to log to a file by enabling 'Log performance data to a local directory'. This can be found within Settings -> Suite -> Performance Update. Alternatively if you start Burp from the command line any exceptions should get logged to either stdout or stderr. If either of these print anything related to your JWT signing then we should be able see what's going on. |
|
In the new version of Burpsuite, when you click SIGN, there is no response (at this time Alg is HS256) |
it have nothing! |
|
@pandak1d Can you post the corresponding key in either PEM or JWK format? |
yes, I can! |
java 17.0.7 |
jdk21 and the same problem. |
|
I think what is happening here is that the classloader is picking up version of the Bouncy Castle within Burp rather than the one packaged within the extension. What version of JWT Editor are you using? The current one within the PortSwigger BApp store does not include its own version of the Bouncy Castle so should not have this problem. |
|
Good day I am using JWT editor 2.3 from BApp and jdk-23 (also tried running from an older version of jdk-17.0.12+7), I encountered a similar problem, when I click on the “Sign” button, the signature does not happen, no visual changes noticed, maybe there is some solution to this problem ? |
|
@ZakFreid This is possibly similar to DolphFlynn/jwt-editor#40 which I believe is caused by using the Burp Suite license crack. Can you try using the Community version and see if it works? |
|
Thanks for the quick reply, yes indeed, when using the clean version, this problem does not occur, it seems that the problem really lies somewhere in the Bouncy Castle library, I tried to get around this restriction by modifying the java.security file in my environment \Java\jdk-23\lib\security and adding BurpSuite to the white list But that didn't help, maybe you have some thoughts on how to get around this limitation ? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have noticed this issue with different lab cases, not with just one case. It is working fine with RSA keys but I am not able to sign the token after creating symmetric keys, and I am not able to complete respective labs. After clicking the ok (shown in the 3rd screenshot below, it does not go anywhere; the pop-up screen just stays there and the token won't get signed. The pop-up disappears if I click cancel though)
screenshots attached below from a portswigger lab(JWT authentication bypass via kid header path traversal) -
Yesterday, I was trying a simple lab of finding the secret using hashcat, creating a symmetric key of the same and signing the token with it. I faced the same issue in that case too. I kept clicking ok to sign but nothing happened. I was able to complete that token and lab using jwt.io. For the latest case mentioned above however, I do not know how to edit 'k' and sign the token if the extension doesn't work.
Any help?
Please let me know if you need any additional info to understand the issue.
Thanks in advance!
The text was updated successfully, but these errors were encountered: