PT0-002 Attacks and Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  JWT algorithm confusion (alg:none)

  Why this is correct

  This is a JWT algorithm confusion attack where the attacker modifies the JWT header to set the `alg` field to `none`, removing the signature entirely. If the server's JWT library naively trusts the header and skips signature verification for `alg:none`, the attacker can forge arbitrary tokens and impersonate any user. Modern libraries should enforce an explicit algorithm allowlist, but misconfigured legacy systems remain vulnerable.

• ✗

  JWT injection

  Why it's wrong here

  JWT injection generally refers to injecting malicious content into the token's payload, such as adding extra claims (e.g., `"role":"admin"`) or embedding payloads that trigger SQL injection or XSS when consumed by the application. That is a payload manipulation or deserialization issue, not an algorithm-level bypass. Here the core flaw is the server accepting `alg:none`, which eliminates signature validation entirely rather than relying on injected data.

• ✗

  JWT session stealing

  Why it's wrong here

  JWT session stealing involves the attacker obtaining a valid, already-issued token from another user, such as via network sniffing, HTTP header leakage, logging, or browser storage theft, then replaying it to hijack that session. It doesn't require altering the token's header or algorithm. In this test, the tester actively crafts a malicious token with `alg:none`, which is fundamentally different from passively or actively stealing a legitimate session token.

• ✗

  JWT secret brute-force

  Why it's wrong here

  JWT secret brute-force is an offline or online attack where the attacker attempts to guess the symmetric HMAC secret used to sign tokens, often using dictionary or wordlist attacks on captured legitimate tokens. However, when `alg:none` is accepted, no signature is present at all, so there is no secret to guess. The vulnerability is that the server skips verification, not that the cryptographic secret is weak or compromised.

Go deeper

Related to this question