EASY Web Security / JWT 🏆 100 pts

jwt web base64 authentication tokens

A JWT (JSON Web Token) was intercepted from an Authorization header in HTTP traffic. The application transmits this token with every authenticated request.

JWT tokens have three parts separated by dots:
header.payload.signature

Each part is Base64URL encoded. Base64URL is like regular Base64 but:
– + becomes -
– / becomes _
– = padding may be omitted

Step 1: Decode the token — paste it at jwt.io or decode manually
Step 2: Read ALL fields in the payload carefully
Step 3: One field contains an encoded value — decode it to reveal the flag

The payload contains a field called “debug_flag”. Its value is base64-encoded. Decode it with: python3 -c “import base64; print(base64.b64decode(‘VALUE’).decode())”

Submit