# LockTalk

We have an interesting website

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2F1G9TiKNwPRrgmuTotmLm%2Fimage.png?alt=media&#x26;token=ed49c03f-e3cd-4cb0-86e8-9b8214231588" alt=""><figcaption></figcaption></figure>

Trying to get a JWT Token results in: Forbidden: Request forbidden by administrative rules.

As seen on the page, we have some API endpoint. Wappalyzer detects Jquery.

Accessing `/api/v1/get_ticket` returned a 403. I could bypass that by calling `//api/v1/get_ticket` and obtain a valid JWT token.
