jwt-misconfig

What problem does it solve?

This Skill helps identify and exploit common misconfigurations in JSON Web Token (JWT) based authentication systems, preventing unauthorized access and privilege escalation.

Core Features & Use Cases

• Detects Algorithmic Confusion: Identifies scenarios where servers incorrectly handle different JWT signing algorithms (e.g., RS256 vs. HS256).
• Exploits alg:none: Leverages JWT libraries that improperly accept tokens with no signature.
• Cracks Weak Secrets: Attempts to brute-force weak or dictionary-based HMAC secrets.
• Identifies kid Parameter Vulnerabilities: Tests for path traversal or SQL injection via the Key ID parameter.
• Use Case: When encountering an Authorization: Bearer <token> header, this skill will attempt to forge a valid token with elevated privileges by exploiting a weak secret or algorithm confusion.

Quick Start

Use the jwt-misconfig skill to test the provided JWT token for common vulnerabilities.