WAPT 2 - JWT

Which part of a JWT is used to verify the token's integrity?

• Header

• Payload

• Signature

• None of the above

What is the primary purpose of the payload in a JWT?

• To encrypt sensitive data

• To store claims or data

• To verify the integrity of the token

• To specify the algorithm used

Which algorithm is commonly used for signing JWTs?

• MD5

• RSA

• HMAC-SHA256

• AES-128

What does "exp" claim in a JWT represent?

• Issuer of the token

• Expiry time of the token

• Subject of the token

• Not Before time

Which header field in JWT specifies the type of token?

• typ

• alg

• kid

• iss

A JWT token is signed using HS256, and you don't have the secret key. What can you do?

• Generate a new JWT with a random secret key

• Modify the token without verifying the signature

• Use a brute force attack to find the secret key

• Modify the payload and it will work without the key

You encounter a JWT where the `alg` field is set to `none`. What does this imply?

• The token is invalid

• The token is not signed

• The token uses a custom algorithm

• The token cannot be decoded

A web application allows you to manipulate the `sub` field of a JWT payload. What potential risk does this pose?

• Data leakage

• Token expiration

• Privilege escalation

• Denial of service

A JWT token has an "iss" claim with the value "trusted_issuer". What happens if this value is tampered with?

• The token will be rejected by the verifier

• The token will lose its signature

• The token will function normally

• The payload will be encrypted

In a real-world scenario, how can a `kid` header in JWT be exploited?

• By brute-forcing the payload

• By supplying an insecure key file path

• By replacing the payload with invalid data

• By using an unknown algorithm