competition-jwt-claim-confusion

Name: competition-jwt-claim-confusion
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-jwt-claim-confusion?

zhaoxuya520/reverse-skill/competition-jwt-claim-confusion

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-jwt-claim-confusion

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspe

Files · 1

View on GitHub

SKILL.md

1	# Competition JWT Claim Confusion
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive bug is not just "there is a JWT," but how headers, claims, and key selection turn into accepted identity.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Split the token path into parse, key lookup, signature or decryption, claim validation, and final acceptance.
12	2. Record header fields, claims, key source, issuer, audience, and role mapping before mutating anything.
13	3. Separate possession of a token from the exact service that accepts it.
14	4. Keep parser behavior, trust policy, and resulting app session or privilege in one chain.
15	5. Reproduce the smallest token-to-acceptance flow that proves the decisive confusion.
16
17	## Workflow
18
19	### 1. Map Header And Key Selection
20
21	- Record header fields such as `alg`, `kid`, `typ`, `cty`, `jku`, or embedded key material when present.
22	- Note where keys come from: static config, JWKS, local file, cache, or dynamic lookup.
23	- Keep token parser, key selection path, and validation mode tied together.
24
25	### 2. Prove Claim-To-Privilege Acceptance
26
27	- Show how subject, audience, issuer, tenant, scope, role, or custom claims become app session, route access, or backend privilege.
28	- Record expiration, not-before, clock skew, issuer matching, audience matching, and claim normalization behavior.
29	- Distinguish token parse success from actual authorization success.
30
31	### 3. Reduce To The Decisive JWT Path
32
33	- Compress the result to the smallest sequence: token supplied -> parser or key path taken -> claim accepted -> resulting capability.
34	- Keep one canonical accepted token path and one mutated token path if confusion or bypass depends on a delta.
35	- If the task broadens into a larger OAuth redirect chain, hand back to the tighter OAuth skill.
36
37	## Read This Reference
38
39	- Load `references/jwt-claim-confusion.md` for the header checklist, claim checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Raw headers, claims, key source, JWKS or local key path, and the accepting service
44	- The exact validation or normalization step that turns the token into accepted identity
45	- One minimal replayable token-to-acceptance sequence

People who liked this also viewed

6 picks

Type

competition-jwt-claim-confusion

8.8kstars1.4kforks

View on GitHub

How to install competition-jwt-claim-confusion?

zhaoxuya520/reverse-skill/competition-jwt-claim-confusion

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-jwt-claim-confusion

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition JWT Claim Confusion
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive bug is not just "there is a JWT," but how headers, claims, and key selection turn into accepted identity.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Split the token path into parse, key lookup, signature or decryption, claim validation, and final acceptance.
12	2. Record header fields, claims, key source, issuer, audience, and role mapping before mutating anything.
13	3. Separate possession of a token from the exact service that accepts it.
14	4. Keep parser behavior, trust policy, and resulting app session or privilege in one chain.
15	5. Reproduce the smallest token-to-acceptance flow that proves the decisive confusion.
16
17	## Workflow
18
19	### 1. Map Header And Key Selection
20
21	- Record header fields such as `alg`, `kid`, `typ`, `cty`, `jku`, or embedded key material when present.
22	- Note where keys come from: static config, JWKS, local file, cache, or dynamic lookup.
23	- Keep token parser, key selection path, and validation mode tied together.
24
25	### 2. Prove Claim-To-Privilege Acceptance
26
27	- Show how subject, audience, issuer, tenant, scope, role, or custom claims become app session, route access, or backend privilege.
28	- Record expiration, not-before, clock skew, issuer matching, audience matching, and claim normalization behavior.
29	- Distinguish token parse success from actual authorization success.
30
31	### 3. Reduce To The Decisive JWT Path
32
33	- Compress the result to the smallest sequence: token supplied -> parser or key path taken -> claim accepted -> resulting capability.
34	- Keep one canonical accepted token path and one mutated token path if confusion or bypass depends on a delta.
35	- If the task broadens into a larger OAuth redirect chain, hand back to the tighter OAuth skill.
36
37	## Read This Reference
38
39	- Load `references/jwt-claim-confusion.md` for the header checklist, claim checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Raw headers, claims, key source, JWKS or local key path, and the accepting service
44	- The exact validation or normalization step that turns the token into accepted identity
45	- One minimal replayable token-to-acceptance sequence

People who liked this also viewed

6 picks

Type