HTB Cyber Apocalypse 2026 — Web Challenge Writeup: JWT Forgery

# HTB Cyber Apocalypse 2026 — JWT Forgery ## Challenge Info - **Category**: Web - **Difficulty**: Medium - **Points**: 325 ## Overview The challenge presented a web application with a login page and an admin panel. The goal was to access the admin dashboard to retrieve the flag. ## Reconnaissance After examining the application, I noticed it used JWT tokens for authentication. The token was stored in a cookie called `auth_token`. ## Exploitation Using `jwt_tool`, I discovered the application was vulnerable to the "none" algorithm attack... ## Flag `HTB{jwt_n0n3_4lg0_1s_d4ng3r0us}`