Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding support for Elliptic Curve based vulnerabilities #28

Open
preetkaran20 opened this issue Sep 25, 2021 · 0 comments
Open

Adding support for Elliptic Curve based vulnerabilities #28

preetkaran20 opened this issue Sep 25, 2021 · 0 comments
Labels
analysis documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers HacktoberFest

Comments

@preetkaran20
Copy link
Member

Is your feature request related to a problem? Please describe.
Currently, we only handle JWT signed using HMAC or RSA but we have not handled the JWT's signed by Elliptic Curve ES384 etc.

Describe the solution you'd like

  1. Analyse the Vulnerabilities related to EC
  2. Adding attack vectors related to that
  3. Adding Custom payload support for EC based keys
  4. Adding the Vulnerable code in https://github.com/SasanLabs/VulnerableApp/blob/master/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java so that we can test the attack vectors.
  5. Add a design document regarding the same.

JWT Configurations
image

Testing the changes, in case some implementation/poc is required
build the addon by running

  1. ./gradlew spotlessApply
  2. ./gradlew build
    Then go to the ZAP -> File -> Local addon file -> Navigate to project -> build -> bin -> jwt*.zap and done.
@preetkaran20 preetkaran20 added documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers Hacktoberfest analysis labels Sep 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
analysis documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers HacktoberFest
Projects
None yet
Development

No branches or pull requests

1 participant