WS Login Service Documentation

Welcome to the WS Login Service. This service allows clients to authenticate and receive a JSON Web Token (JWT) for accessing other web services. The token includes information about the client and is valid for a limited duration.

Endpoint

The service is accessible at the following endpoint:

POST /webservices/rest/ws-login.php

Request Parameters

• client_id (string, required): The unique identifier for the client.
• client_secret (string, required): The secret key associated with the client ID.
• audience (string, required): The intended audience for the token. For example, use http://mutillidae.localhost/webservices/rest/ws-user-account.php if you intend to call that service.

Example Request Using Burp Repeater

Here is how to send a request to the login service using Burp Repeater:

POST /webservices/rest/ws-login.php HTTP/1.1
Host: mutillidae.localhost
Content-Type: application/json
Origin: http://mutillidae.localhost

{
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "audience": "http://mutillidae.localhost/webservices/rest/ws-user-account.php"
}

Instructions:

1. Open Burp Suite and navigate to the Repeater tab.
2. Copy the above request and paste it into the Repeater window.
3. Click Send to see the response from the server.

Example Request Using curl

If you prefer using the command line, here’s how you can make the same request with curl:

curl -X POST "http://mutillidae.localhost/webservices/rest/ws-login.php" \
-H "Content-Type: application/json" \
-d '{
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "audience": "http://mutillidae.localhost/webservices/rest/ws-user-account.php"
}'

Instructions:

1. Open a terminal or command prompt.
2. Copy and paste the above curl command.
3. Press Enter to send the request and view the response.

Expected Response

If everything works correctly, you will receive a response like this:

{
    "access_token": "your-jwt-token",
    "token_type": "bearer",
    "expires_in": 3600
}

Using the JWT Token in Subsequent Requests

After obtaining the token, include it in the Authorization header for any further requests to secured endpoints. Below are examples of how to do this with both curl and Burp Repeater.

Example Using curl

Make a request to an authenticated endpoint (e.g., ws-user-account) using curl:

curl -X GET "http://mutillidae.localhost/webservices/rest/ws-user-account.php" \
-H "Authorization: Bearer your-jwt-token"

Example Using Burp Repeater

To include the JWT token in Burp Suite:

1. Open Burp Suite and navigate to the Repeater tab.
2. Enter the URL of the endpoint, for example:

   GET /webservices/rest/ws-user-account.php HTTP/1.1
   Host: mutillidae.localhost

3. In the Headers section, add an Authorization header:

   Authorization: Bearer your-jwt-token

4. Click Send to submit the request. If the token is valid, you will receive a successful response.

Learn More

Now that you have your JWT token, you can access other authenticated services. Refer to the individual service pages for specific instructions on interacting with each service.