## Jason Web Tarrot
![image](https://user-images.githubusercontent.com/68913871/173015114-747b9fb7-16b9-47f2-90fe-64562ee11143.png)
> After pulling a card, we can see under developer tools that the cookie `token` has a value `eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc1N1YnNjcmliZXIiOmZhbHNlLCJpYXQiOjE2NTQzMDA1NzR9.` The format of this string which starts with `ey` and separated with `.` is an indicator that it is a [JSON Web Token](https://en.wikipedia.org/wiki/JSON_Web_Token)
![image](https://user-images.githubusercontent.com/68913871/173015126-cbf333d0-1b2a-4d49-91c5-1199bb821a17.png)
> A JWT token is divided into 3 components: `Header`, `Payload` and `Signature`, encoded in base64.
![image](https://user-images.githubusercontent.com/68913871/173023191-15830359-ba37-4ad5-949c-0d4373d623dd.png)  [Read more here](https://research.securitum.com/jwt-json-web-token-security/)
> We can use [jwt.io](https://jwt.io/) to decode the token
![image](https://user-images.githubusercontent.com/68913871/173022346-5567e342-a138-4072-b708-3889fd997b7b.png)
> We can see under `Header` that `"alg": "none"` meaning that there is no algorithm, which is indeed the case because the JWT token is missing the last component as seen by the empty string after the 2nd period `.`
> Also to note is that under `Payload`, `"isSubscriber"` is set to `false`. We have to change this to `true` in order to get our flag. We can use CyberChef for this, making sure we set our signing algorithm to None.
![image](https://user-images.githubusercontent.com/68913871/173024741-c762154c-04f4-41e1-814b-ab71f5dfb970.png)
> Edit the cookie value of `token` to the new JWT token `eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc1N1YnNjcmliZXIiOnRydWUsImlhdCI6MTY1NDMwMDU3NH0.` and pull the card once more to get the flag.
![image](https://user-images.githubusercontent.com/68913871/173015141-78e80e9b-1a6e-4c40-ae39-bdf531dd2a30.png)
`bcactf{n0_s3cr3t5????!!!?!_38893}`