Token Trouble

Analyse captured JWTs and an API access log to find a weak signing key, a forged token and an IDOR.

Scenario

Nimbus Pay's customer API hands out JSON Web Tokens at login and trusts them on every call. A customer opened a ticket saying they could see someone else's invoices, and when the responders searched the machine tied to the abuse they found three captured tokens and a small password list from a cracking tool. The API access log rounds out the picture.

Decode the tokens, figure out how the attacker manufactured access, and put your finger on the single request that stepped over an authorization line.