> For the complete documentation index, see [llms.txt](https://the-winrars.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-winrars.gitbook.io/writeups/2020-writeups/ractf/web/getting-admin.md).

# Getting Admin

The next stage of the Quarantine series.

I noticed that our session cookie was a JWT, signed with HS256.

A vulnerability exists where these tokens can have their signing algorithm set to 'none' and their signature removed, and the web app will accept and process it.

I used the highly useful [jwt\_tool](https://github.com/ticarpi/jwt_tool) to resign it, editing my 'privilege' value from '1' to '10'.

This allowed me access to the admin panel (more of a single page).

## ractf{j4va5cr1pt\_w3b\_t0ken}