~/tags/web
Everything on KSAL currently grouped under the #web tag.
Engineering
How JWT algorithm confusion works, why switching RS256 to HS256 lets an attacker sign their own tokens with a public key, and how to shut it down in your own code.
UniVsThreats 26 Quals CTF
A site-native UniVsThreats 26 Quals event writeup that preserves Alpet Gexha's full challenge archive in one place.
BSides Prishtina 2025
A JWT authentication challenge where switching the algorithm from RS256 to HS256 and signing with the server's own public key grants unrestricted admin access.