https://mrbeetrootpwn.com/tags/jwt/Recent content in JWT on CyberSec WriteupsHugoen-usTue, 25 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-craft/Tue, 25 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-craft/Linux Docker machine chaining a REST API JWT secret leaked in Git history, a Python eval() command injection, database credential recovery, and a HashiCorp Vault SSH OTP privilege escalation to root.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-fireflow/Wed, 05 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-fireflow/Linux target combining an unauthenticated Langflow RCE, JWT algorithm confusion, a malicious MCP tool registration, and a Kubernetes nodes/proxy escalation to host root.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hammer/Wed, 29 Jul 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hammer/Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-mentor/Wed, 03 Dec 2025 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-mentor/Linux machine brute-forcing an SNMP community string for API credentials, chaining a command injection into a Docker container, pivoting via ligolo to PostgreSQL, and abusing an SNMP config password for root.