Django - guessable token

---

Description

Write Up: Guillaume
Créateur: WOCSA
Difficulté: Inconnu

---

Enoncé

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

---

Solution détaillée

Exploitation

We can bruteforce or guess the HS256 secret and craft own token, who lead to ATO

PoC

We found is the secret is purple1 with the tool hashcat

Risk

Weak secret lead to ATO and broke the entire authentification system, attacker can delete, modify and take over the any user

Remediation

Use a cryptographic secure secret

---