A JWT algorithm-none attack chained with an API version downgrade writeup from BugForge Labs. The new API rejected the forged token - but the old one didn't.

A predictable admin access token writeup from BugForge Labs. The token looked random at first glance, but comparing it across two accounts revealed a fixed prefix and a brute-forceable 3-character suffix - this is the full process from spotting the cookie to getting the flag.

A UNION-based SQL injection writeup from BugForge Labs. The login page looked safe, but a product endpoint wasn't - this is the full process from finding the injection to dumping the users table and getting the flag.

An IDOR writeup from BugForge Labs. A code snippet sharing app leaked another user's data just by changing a username in the URL - this is the full process from finding the IDOR to leaking the admin's API token and getting the flag.

JWTs are everywhere and so are their misconfigurations. This writeup covers every major JWT attack a pentester needs to know, explained simply with real exploitation steps.