> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2023/web-exploitation/java-code-analysis.md).

# Java Code Analysis!?!

<figure><img src="/files/CpufXvYiDTQ3PpZzOOqm" alt=""><figcaption></figcaption></figure>

If we try inspecting via the js scripts, it just blocks us from viewing.&#x20;

<figure><img src="/files/dHnZeCdWH8uGm9AcesyV" alt=""><figcaption></figcaption></figure>

Looks like we need to dive into the source code. If we look at the "security" folder, we can that the JWT is hard coded with 1234... In otherwords, it's not randomly generated.&#x20;

<figure><img src="/files/IlO6fpfoRW3VzmZagcDm" alt=""><figcaption></figcaption></figure>

Knowing this, we can encode/decode the JWT with the secret string. We first open up devtools and head over to Local Storage. A lot of JWT are stored in either your Local Storage, Session Storage, or Cookies.&#x20;

<figure><img src="/files/kiDhJ66sWxpTllype0tp" alt=""><figcaption></figcaption></figure>

We then head over to encode our JWT to fit admin privileges. Since we know the secret is 1234, we can do it quite easily. We change the headers to Admin for both sections and reduce the UserID to something other than 1&#x20;

<figure><img src="/files/rmBnnVZdpyDlQwWD5qmh" alt=""><figcaption></figcaption></figure>

Once we change our JWT, we can then insert it into DevTools on our Local Storage.&#x20;

<figure><img src="/files/TlhTmG7YZg2dCEv87NSz" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/LGfA4QHrPR45EXjWMTw5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/vNWJwecwhsCD9Nshkofx" alt=""><figcaption></figcaption></figure>

Once we restart the browser, we can log in with Admin Access!&#x20;