Source:
private boolean executeAlgoKeyConfusionAttack() throws JWTException { try { KeyStore keyStore = KeyStore.getInstance("PKCS12"); String trustStorePath = JWTConfiguration.getInstance().getTrustStorePath(); if (StringUtils.isEmpty(trustStorePath)) { trustStorePath = System.getProperty("javax.net.ssl.trustStore"); } if (StringUtils.isNotEmpty(trustStorePath)) { String algoType = this.serverSideAttack.getJwtTokenBean().getAlgorithm(); if (algoType.startsWith(JWT_RSA_ALGORITHM_IDENTIFIER)) { String newJwtHeader = String.format(JWT_HEADER_WITH_ALGO_PLACEHOLDER, HMAC_256); String base64EncodedNewHeaderAndPayload = JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString(newJwtHeader) + JWT_TOKEN_PERIOD_CHARACTER + JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString( this.serverSideAttack.getJwtTokenBean().getPayload()); char[] password = JWTConfiguration.getInstance().getTrustStorePassword().toCharArray(); keyStore.load(new FileInputStream(trustStorePath), password); while (keyStore.aliases().hasMoreElements()) { if (this.serverSideAttack.getJwtActiveScanner().isStop()) { return false; } String alias = keyStore.aliases().nextElement(); Certificate certificate = keyStore.getCertificate(alias); Key publicKey = certificate.getPublicKey(); JWTTokenBean clonedJWTokenBean = JWTTokenBean.parseJWTToken( base64EncodedNewHeaderAndPayload + JWT_TOKEN_PERIOD_CHARACTER + JWTUtils.getBase64EncodedHMACSignedToken( JWTUtils.getBytes( base64EncodedNewHeaderAndPayload), publicKey.getEncoded(), HMAC_256)); if (verifyJWTToken( clonedJWTokenBean.getBase64EncodedToken(), serverSideAttack)) { raiseAlert( MESSAGE_PREFIX, VulnerabilityType.ALGORITHM_CONFUSION, Alert.RISK_HIGH, Alert.CONFIDENCE_HIGH, clonedJWTokenBean.getBase64EncodedToken(), serverSideAttack); return true; } } } } } catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | IOException e) { new JWTException( "Exception occurred while getting manipulated token for confusion scenario", e); } return false; }

Target:
private boolean executeAlgoKeyConfusionAttack() throws JWTException { try { KeyStore keyStore = KeyStore.getInstance("PKCS12"); String trustStorePath = JWTConfiguration.getInstance().getTrustStorePath(); if (StringUtils.isEmpty(trustStorePath)) { trustStorePath = System.getProperty("javax.net.ssl.trustStore"); } if (StringUtils.isNotEmpty(trustStorePath)) { String algoType = this.serverSideAttack.getJwtHolder().getAlgorithm(); if (algoType.startsWith(JWT_RSA_ALGORITHM_IDENTIFIER)) { String newJwtHeader = String.format(JWT_HEADER_WITH_ALGO_PLACEHOLDER, HMAC_256); String base64EncodedNewHeaderAndPayload = JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString(newJwtHeader) + JWT_TOKEN_PERIOD_CHARACTER + JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString( this.serverSideAttack.getJwtHolder().getPayload()); char[] password = JWTConfiguration.getInstance().getTrustStorePassword().toCharArray(); try (FileInputStream fileInputStream = new FileInputStream(trustStorePath)) { keyStore.load(fileInputStream, password); while (keyStore.aliases().hasMoreElements()) { if (this.serverSideAttack.getJwtActiveScanner().isStop()) { return false; } String alias = keyStore.aliases().nextElement(); Certificate certificate = keyStore.getCertificate(alias); Key publicKey = certificate.getPublicKey(); JWTHolder clonedJWTHolder = JWTHolder.parseJWTToken( base64EncodedNewHeaderAndPayload + JWT_TOKEN_PERIOD_CHARACTER + JWTUtils.getBase64EncodedHMACSignedToken( JWTUtils.getBytes( base64EncodedNewHeaderAndPayload), publicKey.getEncoded(), HMAC_256)); if (verifyJWTToken( clonedJWTHolder.getBase64EncodedToken(), serverSideAttack)) { raiseAlert( MESSAGE_PREFIX, VulnerabilityType.ALGORITHM_CONFUSION, Alert.RISK_HIGH, Alert.CONFIDENCE_HIGH, clonedJWTHolder.getBase64EncodedToken(), serverSideAttack); return true; } } } } } } catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | IOException e) { new JWTException( "An exception occurred while getting manipulated token for confusion scenario", e); } return false; }