-
-
Notifications
You must be signed in to change notification settings - Fork 13
Open
Labels
HacktoberFestanalysisdocumentationImprovements or additions to documentationImprovements or additions to documentationenhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers
Description
Is your feature request related to a problem? Please describe.
Currently, we only handle JWT signed using HMAC or RSA but we have not handled the JWT's signed by Elliptic Curve ES384 etc.
Describe the solution you'd like
- Analyse the Vulnerabilities related to EC
- Adding attack vectors related to that
- Adding Custom payload support for EC based keys
- Adding the Vulnerable code in https://github.com/SasanLabs/VulnerableApp/blob/master/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java so that we can test the attack vectors.
- Add a design document regarding the same.
Testing the changes, in case some implementation/poc is required
build the addon by running
- ./gradlew spotlessApply
- ./gradlew build
Then go to the ZAP -> File -> Local addon file -> Navigate to project -> build -> bin -> jwt*.zap and done.
Metadata
Metadata
Assignees
Labels
HacktoberFestanalysisdocumentationImprovements or additions to documentationImprovements or additions to documentationenhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers
