│ Category: Web Exploitation
│ Author: Imattas aka Zemi
│ Flag:
byuctf{idk_if_this_means_anything_but_maybe_its_useful_somewhere_97ba5a70d94d}
│ Source Path: web/jwtf
────────────────────────────────────────────────────────────────────────────────
--[ Challenge Description ]--
-- text --
Unfortunately one of our JWTs was compromised by attackers, so we created a JWT Revocation List to ensure they can't use it anymore.
https://jwtf.chal.cyberjousting.com
[jwtf.zip]
────────────────────────────────────────────────────────────────────────────────
--[ Provided Materials ]--
- Repository folder https://github.com/BYU-CSA/BYUCTF-2025/tree/main/web/jwtf
- web/jwtf/README.md
https://github.com/BYU-CSA/BYUCTF-2025/blob/main/web/jwtf/README.md
- web/jwtf/jwtf.zip
https://github.com/BYU-CSA/BYUCTF-2025/blob/main/web/jwtf/jwtf.zip
────────────────────────────────────────────────────────────────────────────────
--[ Recon / Initial Analysis ]--
This page imports the BYUCTF 2025 source material for the Web Exploitation
challenge JWTF. The prompt is kept separate from the solve notes, and upstream
artifacts are linked so the challenge can be replayed from the original
repository.
────────────────────────────────────────────────────────────────────────────────
--[ Vulnerability / Observation ]--
The useful observation comes from the imported solve notes below. I kept the
original technical path intact while normalizing the page metadata, challenge
grouping, and author attribution for the Volume 2 writeup archive.
────────────────────────────────────────────────────────────────────────────────
--[ Exploitation / Solution ]--
Source: web/jwtf/README.md
https://github.com/BYU-CSA/BYUCTF-2025/blob/main/web/jwtf/README.md
The way to get around this is by taking advantage of the fact that the signature
is base64-encoded. Let's take a token like eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJhZG1pbiI6dHJ1ZSwidWlkIjoiMTMzNyJ9.TYXuhKJG6sb3ck9UZgzbIFaZ2WLK2JeN8Q5Mj_UnvZk
. The last section, TYXuhKJG6sb3ck9UZgzbIFaZ2WLK2JeN8Q5Mj_UnvZk is decoded to ht
tps://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false
ToHex('Space',0)&input=VFlYdWhLSkc2c2IzY2s5VVpnemJJRmFaMldMSzJKZU44UTVNal9VbnZaa
w&oeol=FF) `4d 85 ee 84 a2 46 ea c6 f7 72 4f 54 66 0c db 20 56 99 d9 62 ca d8 97
8d f1 0e 4c 8d 49 ef 66`. However, if you change the last character `k` to the
next letter in the base64 alphabet, `l`, it [ALSO decodes to the same thing](htt
ps://gchq.github.io/CyberChef/#recipe=FromBase64('A-Za-z0-9%2B/%3D',true,false)T
o_Hex('Space',0)&input=VFlYdWhLSkc2c2IzY2s5VVpnemJJRmFaMldMSzJKZU44UTVNal9VbnZab
A&oeol=FF). Therefore you can change the last letter of the signature and it
will be base64-decoded into the same signature.
curl http://localhost:5002/flag -H 'Cookie:
session=<insert_jrl_token_but_change_last_char>
Note that adding whitespace or equal signs won't work because those are
specifically filtered out. Also, changing any bytes of the other two sections
will also not work because the signature is based on the hash of
section1.section2 in their base64-encoded forms.
Flag -
byuctf{idk_if_this_means_anything_but_maybe_its_useful_somewhere_97ba5a70d94d}
────────────────────────────────────────────────────────────────────────────────
--[ Full Exploit Script ]--
No standalone exploit script was present in the selected source material.
────────────────────────────────────────────────────────────────────────────────
--[ Key Takeaways ]--
- The BYUCTF 2025 challenge material is preserved with local archive formatting.
- The page author is normalized to Imattas aka Zemi.
- The source repository remains linked for handouts, services, and solve
artifacts.