Medium
JWT Attacks
SkyView RS256/HS256 key confusion
A drone-fleet dispatch console. The RS256 verifier also accepts HS256, using the same public key as the HMAC secret.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 1
- Published
- 25 Aug 2026
Scenario
SkyView issues RS256-signed tokens verified against a public key served from a /jwks-style endpoint. The same verifier also accepts HS256 for that key value.
Goal
Forge a token that makes you an admin (login only gives role=operator); the response returns the flag once your token is accepted as admin. The verifier's public key is downloadable at /jwks.php.