jwt-attacks

Contents

• Scope & authorization
• Step 0 - locate the token and establish a baseline
• Step 1 - offline HMAC secret crack (passive)
• Step 2 - signature stripping (active)
• Step 3 - alg:none family (active)
• Step 4 - kid manipulation (active)
• Step 5 - self-signed key injection: jwk / jku (active)
• Step 6 - RS256->HS256 algorithm confusion (active)
• Runnable snippets
• Output

Scope & authorization

Only run against an application you own or are engaged to test. The offline secret-cracking step (Step 1) is fully passive - it only analyzes a token you already captured and makes no network requests, so it is always safe to run. Every forgery step after it is active: it replays a tampered token against the live server, which mutates the authenticated session and appears in the target's logs. Do not run the active steps against third-party or out-of-scope hosts.

Inputs are the JWTs you already hold - captured from proxy history, a browser session, or an Authorization header the app issued to you. Outputs are "report a finding when the server accepts a token you forged."

Step 0 - locate the token and establish a baseline

1. Find the JWT. In each captured request, read the Authorization header. Strip a leading Bearer if present. A JWT is three base64url segments joined by dots (header.payload.signature) and the header segment almost always starts with ey (that is {" base64url-encoded). Tokens also appear in cookies and in access_token / id_token body or query params - check those too. Skip any auth header whose value does not start with ey; after ~3 non-JWT auth values on a host, move on.
2. Decode it (passive). base64url-decode segment 1 (header) and segment 2 (payload). Note alg, kid, jku, jwk in the header and exp, iat, roles/scopes/sub in the payload - these drive both the crack and the forgeries.
3. Establish the rejection baseline (active). Before forging anything, confirm the endpoint actually enforces the token: replay the request with a deliberately invalid token (original token with its last signature character changed) and confirm the server answers 401 Unauthorized. Only endpoints that reject a bad token are worth attacking - if an endpoint returns 200 for garbage, it never checked the token and the "forgery accepted" signal is meaningless. Rate-limit yourself: after ~5 filtered requests that fail to return 401 to an invalid token, stop on that host.