Learn JWT attacks on a Moon mission in Last Window
Drive a rover across the Moon, fly a lander and dock with the mothership waiting in lunar orbit. After 60 seconds the flight computer locks and asks for an expedition licence. You don't have one. Find a way to get it.
The physics, simply
- The Moon has weak gravity. About one sixth of Earth's. You can jump six times higher there, and the lander falls slowly.
- There is no air at all. No wings, no parachutes. The only way to slow down is to point your engine the way you are going and fire it.
- Once you move, you keep moving. Nothing slows you down in space. Small thrusters turn you and move you a little bit. To stop, you push the other way.
- Docking is slow on purpose. Get close, match your speed with the mothership, then touch very gently.
A small hint
Who does the game think you are? Have a look at what the game stores in your browser about you. It has three parts, separated by dots. Does the server really check them?
Why this matters
JWTs are everywhere: logins, mobile apps, APIs. A token is only safe if the server checks its signature every time. Skip that check and anyone can tell the server they are an admin. It is a small mistake with a very big impact, and it is still found in real systems.
Don't want to hack? There is a free play mode too. Just fly.
CyberLearner.org is a free cybersecurity training platform, built on the curriculum of the International Cybersecurity Olympiad (ICO). Every lab is hands-on and runs in your browser. It is open to everyone, regardless of skill level.