Mini-game · Chapter 3

JWT Lab

Two challenges in a safe sandbox. Two simulated servers, each with a different JWT mistake. Forge a token that makes you an admin. All HMAC signing happens locally with the Web Crypto API.

Educational training material. This game demonstrates an attack technique inside a sandboxed quiz UI for security learning. Do not apply these techniques against systems you do not own or have explicit written permission to test.

Challenge 1 / 2 Score 0 Time 00:00