HTB CWEE: Modern Web Stack and API Exploitation

Modern Web Stack and API Exploitation covers JWT, OAuth, GraphQL, WebSockets, and cloud-integrated services. CWEE tests whether you understand protocol-specific trust boundaries and can exploit them without relying on generic web payloads.

Tokens and protocols

For JWT, decode header and claims, test alg:none, weak HMAC secrets, kid path injection, and JWK or JKU injection. Do not confuse decoding with verification. For OAuth, inspect redirect_uri validation, state handling, PKCE, scope upgrades, and token leakage in referrers. For GraphQL, try introspection, field suggestions, batching, aliases, and nested queries that bypass per-object authorization. For WebSockets, check origin validation, authentication on the upgrade, and message-level authorization. Cloud-integrated services may expose signed URLs, metadata credentials, or permissive CORS.

Worked example

A GraphQL endpoint disables introspection but still returns field suggestions. A query for user(id:2){email role} succeeds with a low-privilege token, revealing another user's email and role. The issue is missing object-level authorization in the resolver, not a GraphQL misconfiguration alone.

Traps

Treating base64-decoded JWT claims as trusted is a common error. alg:none may be rejected while weak-secret cracking succeeds. OAuth redirect_uri checks may allow path suffixes or subdomain tricks. Disabling introspection does not disable queries. WebSocket authorization must be tested per message, not only at connect time.