API Token Attacks

Token Analysis with Burp Suite Sequencer

Analysis Process

• Utilize Burp Suite to analyze tokens for predictability and aid in token forgery attacks.

• Proxy the API authentication request to Burp Suite.

• Forward the request to Sequencer for token analysis.

• Use Live Capture to interact with the target and capture live tokens.

• Define the custom location of the token within the response for analysis.

Live Capture and Analysis

1. Configure the custom location of the token.

2. Start live capture to process thousands of requests.

3. Use the "Analyze now" button to see results sooner.

4. Evaluate the randomness and complexity of the analyzed tokens.

5. Identify predictable patterns or weaknesses in the token generation process.

Example: crAPI Token Analysis

• Demonstrates that tokens generated by crAPI seem sufficiently random and complex.

• Sequencer helps identify if tokens are predictable or lack randomness.

• Sequential token generation can lead to predictable tokens, even if seemingly complex.

Poor Token Generation Process

• Analyze "bad tokens" from the Hacking APIs Github repository.

• Use the Manual load option to provide a set of bad tokens.

• Analyze the tokens to identify patterns or weaknesses in the token generation process.

JWT Attacks

JWT Security

JWT Tool

• Utilize the jwt_tool for JWT attacks.

• Example Commands:

  $ jwt_tool -t http://target-name.com/ -rh "Authorization: Bearer JWT_Token" -M pb
  $ jwt_tool -t http://127.0.0.1:8888/identity/api/v2/user/dashboard -rh "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..."

Types of JWT Attacks

1. The None Attack

2. The Algorithm Switch Attack

   $ jwt_tool eyJhbGciOiJIUzUxMiJ9... -X a

3. JWT Crack Attack

   $ crunch 5 5 -o crAPIpw.txt
   $ jwt_tool TOKEN -C -d /wordlist.txt

These techniques allow you to analyze tokens for vulnerabilities, identify weaknesses in token generation, and perform targeted attacks, such as JWT manipulation and cracking. By understanding the characteristics of tokens, you can enhance the security of the API authentication process.