Beta

This catalog is a work in progress — I'm actively polishing it and adding new labs.

0xBugLabs
← All labs
MediumAuth

Meridian — two ways to break authentication

A small banking-style customer portal with two unrelated authentication bugs — one in how password resets are proven, one in how sessions are verified. Neither depends on the other.

Node.jsExpressEJScustom JWT

Run it locally

git clone https://github.com/G3kSec/0xBugLabs.git
cd 0xBugLabs/labs/auth/meridian-token-flaws
docker compose up -d

The app is at http://localhost:8083. Tear down with docker compose down.

Objectives (2)

  1. 01

    Take over another customer's account via password reset

    The reset flow gives you a token for your own account. Look closely at what that token actually contains before assuming it's random.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.Request a reset and look closely at the token. Does it look random, or does it look encoded?
    2. 2.Try base64-decoding it — then think about what else in that decoded value you could change.
  2. 02

    Reach the admin console without admin credentials

    Sessions here are JWTs. You'll never see the signing secret — you're not meant to need it.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.A JWT's header declares which algorithm was used to sign it. What is that field actually trusted to say?
    2. 2.What happens if you set `alg` to `none` and drop the signature entirely?
authpredictable-tokenaccount-takeoverjwtalg-none
View lab source →Solution walkthrough (spoilers) →