Add generate_jwt & json_{minify,prettify} helper functions #3160

dwisiswant0 · 2023-01-06T14:46:48Z

Proposed changes

This change defines several functions that manipulate JSON strings in different ways:

The generate_jwt function generates a JSON Web Token (JWT) using the claims provided in a JSON string, the signature, and the specified algorithm.
The json_minify function minifies a JSON string by removing unnecessary whitespace.
The json_prettify function prettifies a JSON string by adding indentation.

Checklist

Pull request is created against the dev branch
All checks passed (lint, unit/integration/regression tests etc.) with my changes
I have added tests that prove my fix is effective or that my feature works
I have added necessary documentation (if appropriate) (Add JSON helper function documentations nuclei-docs#110)

v2/pkg/operators/common/dsl/dsl.go

dwisiswant0 · 2023-01-07T10:22:24Z

Because the input from generate_jwt uses an interface{} type, therefore using the quote_escape function is not really necessary, so I decided to delete it.

Here is an update test case:

Template:

# template.yaml
id: generate-jwt-helper-functions

info:
  name: RAW Template with generate_jwt Helper Functions
  author: dwisiswant0
  severity: info

variables:
  json: |
    {
      "name": "John Doe",
      "foo": "bar"
    }
  json_compact: |
    {"name": "John Doe","foo": "bar"}
  maxAge: '{{to_unix_time("2034-12-30T16:30:10+00:00")}}'

requests:
  - raw:
      - |+ # Generate JWT & minify the JSON data
        POST /generate_jwt HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "HS256", "hello-world")}}
        X-Notes: This-JWT-should-be-the-same-as-the-JSON-compact-data-in-the-request-below

        {{json_minify(json)}}

      - |+ # Generate JWT with compact data & prettify
        POST /generate_jwt-prettify HTTP/1.1
        Authorization: Bearer {{generate_jwt(json_compact, "HS256", "hello-world")}}
        X-Notes: This-JWT-should-be-the-same-as-the-normal-JSON-data-in-the-request-above

        {{json_prettify(json_compact)}}

      - |+ # With none algorithm
        GET /generate_jwt-none HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "nOnE")}}

      - |+ # With empty signature
        GET /generate_jwt-empty-signature HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "HS256", "")}}

      - |+ # With max age defined
        GET /generate_jwt-max-age HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "HS256", "hello-world", maxAge)}}

Usage:

$ go run cmd/nuclei/main.go -duc -t template.yaml -debug-req -u http://localhost 

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.6

		projectdiscovery.io

[INF] Using Nuclei Engine 2.8.6 (outdated)
[INF] Using Nuclei Templates  (outdated)
[INF] Templates added in last update: 0
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[INF] [generate-jwt-helper-functions] Dumped HTTP request for http://localhost/generate_jwt

POST /generate_jwt HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.EsrL8lIcYJR_Ns-JuhF3VCllCP7xwbpMCCfHin_WT6U
X-Notes: This-JWT-should-be-the-same-as-the-JSON-compact-data-in-the-request-below

{"foo":"bar","name":"John Doe"}

[INF] [generate-jwt-helper-functions] Dumped HTTP request for http://localhost/generate_jwt-prettify

POST /generate_jwt-prettify HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.EsrL8lIcYJR_Ns-JuhF3VCllCP7xwbpMCCfHin_WT6U
X-Notes: This-JWT-should-be-the-same-as-the-normal-JSON-data-in-the-request-above

{
    "name": "John Doe",
    "foo": "bar"
}


[INF] [generate-jwt-helper-functions] Dumped HTTP request for http://localhost/generate_jwt-none

GET /generate_jwt-none HTTP/1.1
Authorization: Bearer eyJhbGciOiJOT05FIiwidHlwIjoiSldUIn0.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.

[INF] [generate-jwt-helper-functions] Dumped HTTP request for http://localhost/generate_jwt-empty-signature

GET /generate_jwt-empty-signature HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.mba3WxAJP0ExW7yzDTAG3jslEQj5HfhBos6bD0R6ABQ

[INF] [generate-jwt-helper-functions] Dumped HTTP request for http://localhost/generate_jwt-max-age

GET /generate_jwt-max-age HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE2NzMwODY4OTgsImV4cCI6MjA1MTEwOTAxMH0.d_HzXqMXnKN1KXVQszwQIStAFv3nIPba1qUs-9KS3iA

[INF] No results found. Better luck next time!

tarunKoyalwar

lgtm!

tarunKoyalwar · 2023-01-13T11:42:56Z

Things to Note

Dependency https://github.com/kataras/jwt
~~If given optional algorithm is empty or none,None (any other case . the algorithm value in jwt string is set toNONE~~

tarunKoyalwar · 2023-01-13T11:45:23Z

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.6

		projectdiscovery.io

[INF] Using Nuclei Engine 2.8.6 (latest)
[INF] Using Nuclei Templates 9.3.4 (latest)
[INF] Templates added in last update: 15
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[INF] [generate-jwt-helper-functions] Dumped HTTP request for https://scanme.sh/generate_jwt

POST /generate_jwt HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36
Connection: close
Content-Length: 33
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.EsrL8lIcYJR_Ns-JuhF3VCllCP7xwbpMCCfHin_WT6U
X-Notes: This-JWT-should-be-the-same-as-the-JSON-compact-data-in-the-request-below
Accept-Encoding: gzip

{"foo":"bar","name":"John Doe"}


POST /generate_jwt-prettify HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 47
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.EsrL8lIcYJR_Ns-JuhF3VCllCP7xwbpMCCfHin_WT6U
X-Notes: This-JWT-should-be-the-same-as-the-normal-JSON-data-in-the-request-above
Accept-Encoding: gzip

{
    "name": "John Doe",
    "foo": "bar"
}



GET /generate_jwt-none HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Authorization: Bearer eyJhbGciOiJOT05FIiwidHlwIjoiSldUIn0.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.
Accept-Encoding: gzip



GET /generate_jwt-empty-signature HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.mba3WxAJP0ExW7yzDTAG3jslEQj5HfhBos6bD0R6ABQ
Accept-Encoding: gzip



GET /generate_jwt-max-age HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36
Connection: close
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE2NzM2MTAyNTUsImV4cCI6MjA1MTEwOTAxMH0.9Tc-zNnc0IpVfnnLrUDLUB2WDZODj5lz1mVqkwswdeI
Accept-Encoding: gzip

dwisiswant0 · 2023-01-13T11:58:45Z

...

If given algorithm is none,None etc . the algorithm value in jwt string is alwaysNONE

I regret to inform you that the notes provided require correction. If the supplied optionalAlgorithm argument is an empty string (""), None/nOnE (any mixed-case) - then it's set as NONE, otherwise, and/or not listed in case of R844-R869 (after converting its value to uppercase), it will return an error.

tarunKoyalwar · 2023-01-13T12:05:55Z

@dwisiswant0 , If I am not wrong If I want alg type to be noNe in jwt string . It is not possible here because we use jwt.NONE interfact/struct .
Ex: If we take jwt string from example 3 the jwt string is

tarunKoyalwar · 2023-01-13T12:07:44Z

@dwisiswant0 , I explicitly wanted to mention above case but I have also updated my earlier comment

tarunKoyalwar · 2023-01-13T12:32:23Z

Minor Improvements

none jwt alg value is not converted to uppercase anymore

# template.yaml
id: generate-jwt-helper-functions

info:
  name: RAW Template with generate_jwt Helper Functions
  author: dwisiswant0
  severity: info

variables:
  json: |
    {
      "name": "John Doe",
      "foo": "bar"
    }
  json_compact: |
    {"name": "John Doe","foo": "bar"}
  maxAge: '{{to_unix_time("2034-12-30T16:30:10+00:00")}}'

requests:
  - raw:
      - |+ # With none algorithm
        GET /generate_jwt-none HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "nOnE")}}

      - |+ # With none algorithm
        GET /generate_jwt-none HTTP/1.1
        Authorization: Bearer {{generate_jwt(json, "nONe")}}

./nuclei -u https://scanme.sh -t ~/test/jwtfuzz.yaml -debug-req

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.6

		projectdiscovery.io

[INF] Using Nuclei Engine 2.8.6 (latest)
[INF] Using Nuclei Templates 9.3.4 (latest)
[INF] Templates added in last update: 15
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[INF] [generate-jwt-helper-functions] Dumped HTTP request for https://scanme.sh/generate_jwt-none

GET /generate_jwt-none HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
Connection: close
Authorization: Bearer eyJhbGciOiJuT25FIiwidHlwIjoiSldUIn0.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.
Accept-Encoding: gzip

[INF] [generate-jwt-helper-functions] Dumped HTTP request for https://scanme.sh/generate_jwt-none

GET /generate_jwt-none HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Connection: close
Authorization: Bearer eyJhbGciOiJuT05lIiwidHlwIjoiSldUIn0.eyJmb28iOiJiYXIiLCJuYW1lIjoiSm9obiBEb2UifQ.
Accept-Encoding: gzip

[INF] No results found. Better luck next time!

tarunKoyalwar · 2023-01-13T12:33:25Z

dwisiswant0 added 3 commits January 6, 2023 19:30

feat(dsl): add generate_jwt helper func

cb068cd

feat(dsl): add json_{minify,prettify} & quote_escape

da1b1e7

update(dsl): change type of data var to map[string]interface{}

bc10b2d

dwisiswant0 marked this pull request as draft January 6, 2023 14:47

dwisiswant0 mentioned this pull request Jan 6, 2023

Add CVE-2023-22463 projectdiscovery/nuclei-templates#6479

Closed

3 tasks

dwisiswant0 marked this pull request as ready for review January 6, 2023 14:57

ehsandeep changed the base branch from main to dev January 6, 2023 15:06

ehsandeep requested a review from tarunKoyalwar January 6, 2023 15:07

dwisiswant0 added 2 commits January 6, 2023 22:17

docs(dsl): list valid algos for generate_jwt

8b137ab

test(dsl): add test case for json_{minify,prettify} & quote_escape

8eaaeb2

tarunKoyalwar requested changes Jan 6, 2023

View reviewed changes

v2/pkg/operators/common/dsl/dsl.go Outdated Show resolved Hide resolved

dwisiswant0 marked this pull request as draft January 7, 2023 01:18

dwisiswant0 added 2 commits January 7, 2023 14:12

update(dsl): refactor generate_jwt

c6cd9d0

fix(lint): use time.Until instead of t.Sub(time.Now()) (gosimple)

ea410c7

dwisiswant0 marked this pull request as ready for review January 7, 2023 07:18

dwisiswant0 requested a review from tarunKoyalwar January 7, 2023 07:18

revert(dsl): remove quote_escape func

3e34e83

dwisiswant0 force-pushed the feat/helper/generate_jwt branch from ccbc283 to 3e34e83 Compare January 7, 2023 10:17

dwisiswant0 changed the title ~~Add generate_jwt, json_{minify,prettify} & quote_escape helper functions~~ Add generate_jwt & json_{minify,prettify} helper functions Jan 7, 2023

tarunKoyalwar approved these changes Jan 13, 2023

View reviewed changes

tarunKoyalwar requested a review from ehsandeep January 13, 2023 11:46

tarunKoyalwar removed the request for review from ehsandeep January 13, 2023 12:11

tarunKoyalwar added 2 commits January 13, 2023 17:48

ability to fuzz jwt noNe algorithm

1c90432

fix lint error

2221737

jwt dsl minor improvement

6b5506f

tarunKoyalwar requested a review from ehsandeep January 13, 2023 12:40

ehsandeep approved these changes Jan 15, 2023

View reviewed changes

ehsandeep merged commit 94ec553 into projectdiscovery:dev Jan 15, 2023

dwisiswant0 deleted the feat/helper/generate_jwt branch January 15, 2023 17:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add generate_jwt & json_{minify,prettify} helper functions #3160

Add generate_jwt & json_{minify,prettify} helper functions #3160

dwisiswant0 commented Jan 6, 2023 •

edited

Loading

dwisiswant0 commented Jan 7, 2023 •

edited by tarunKoyalwar

Loading

tarunKoyalwar left a comment

tarunKoyalwar commented Jan 13, 2023 •

edited

Loading

tarunKoyalwar commented Jan 13, 2023

dwisiswant0 commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

Add generate_jwt & json_{minify,prettify} helper functions #3160

Add generate_jwt & json_{minify,prettify} helper functions #3160

Conversation

dwisiswant0 commented Jan 6, 2023 • edited Loading

Proposed changes

Checklist

dwisiswant0 commented Jan 7, 2023 • edited by tarunKoyalwar Loading

tarunKoyalwar left a comment

Choose a reason for hiding this comment

tarunKoyalwar commented Jan 13, 2023 • edited Loading

Things to Note

tarunKoyalwar commented Jan 13, 2023

dwisiswant0 commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

tarunKoyalwar commented Jan 13, 2023

Minor Improvements

tarunKoyalwar commented Jan 13, 2023

dwisiswant0 commented Jan 6, 2023 •

edited

Loading

dwisiswant0 commented Jan 7, 2023 •

edited by tarunKoyalwar

Loading

tarunKoyalwar commented Jan 13, 2023 •

edited

Loading