Loading
A student at Vidyapeeth College Portal copied their login token to show a friend how sessions work. The token is a JWT: three parts joined by dots.
Here is the secret most beginners miss: the middle part of a JWT, the payload, is only Base64url-encoded, not encrypted. Anyone who holds the token can read it. Real sites have leaked private data this way.
What you are given: the full token below.
What to find: decode the payload, read it as JSON, and find the claim that holds an encoded secret. Decode that value to get the flag, which starts with the letters MXC in braces.
What to use: the Researcher Toolkit decoder, or any Base64url decoder. Do not try to crack the signature. That is not needed and it is not the lesson.
Token:
eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJzdWIiOiAiZ3Vlc3RfMTA0MiIsICJuYW1lIjogIkRlbW8gU3R1ZGVudCIsICJzZWNyZXRfbm90ZSI6ICJUVmhEZTJwM2RGOXdZWGxzYjJGa1gybHpYM0IxWW14cFkxOWhNSEYxZlE9PSJ9.bm90YXJlYWxzaWduYXR1cmU
Submit the flag when you have it.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.