Challenge 59 of 66

Key Injector

🔴 Elite Auth +150 XP

A JWT uses a "kid" header parameter to select the signing key from a file. Inject a path traversal to use /dev/null as the key.

Key Injector // sandbox

If kid points to /dev/null (empty file), the signature is verified against an empty secret.

Know someone who would enjoy this? Challenge them.

Keep going

Make it count. Join free to earn XP for what you read and solve, keep a streak, and track your progress.