skills.rest
mccleod1290
mccleod1290COMMUNITY
Explore all skills by this author →
GitHub

offensive-jwt

Tests JWT implementations for algorithm confusion, weak secrets, and header injection vulnerabilities.

1|Updated Jul 2, 2026
Search Tags:#jwt#penetration testing#web security#bug bounty#token security#authentication bypass#algorithm confusion
One-click install
npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill offensive-jwt-mccleod1290
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-jwt
Source: https://github.com/mccleod1290/bb-agentic-setupv2/tree/main/web-skills/JWT
Command: npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill offensive-jwt-mccleod1290

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Penetration testers need a systematic methodology to attack JWT-based authentication, and ad-hoc testing often misses critical misconfigurations like algorithm confusion, weak HMAC secrets, or header parameter injection that lead to full auth bypass. ## Core Features & Use Cases - Algorithm Attack Coverage: Step-by-step procedures for alg:none bypass, RS256-to-HS256 confusion, and HMAC secret brute forcing with jwt_tool and hashcat. - Header Injection Testing: Payloads and techniques for kid SQL injection and path traversal, jku/x5u/jwk injection, and JWKS cache poisoning. - Mobile & Advanced Vectors: JWT extraction from Android SharedPreferences, iOS Keychain, and React Native AsyncStorage, plus timing attacks, token confusion, and URL leakage checks. - Use Case: During a bug bounty engagement, you intercept a Bearer token, decode it, discover a kid parameter, and follow the checklist to test path traversal via kid, ultimately forging a valid token signed with the contents of /dev/null. ## Quick Start Ask the AI to analyze this JWT for vulnerabilities and walk through the algorithm confusion and kid injection test cases against my authorized target.

Frequently Asked Questions about offensive-jwt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a JWT for algorithm confusion attacks?▼

Algorithm confusion testing switches the token's alg header from RS256 to HS256 and re-signs it using the server's RSA public key as the HMAC secret. If the server uses the public key for HMAC verification, the forged token is accepted. Tools like jwt_tool automate this with the -X k flag.

How to brute force a weak JWT HMAC secret?▼

Brute forcing a JWT HMAC secret uses jwt_tool with the -C flag and a wordlist, or hashcat for faster cracking. The attack works because HS256 uses a symmetric shared secret, so anyone who guesses it can forge valid tokens for any user.

What is JWT kid parameter injection?▼

kid injection exploits the key ID header parameter that tells the server which key to use for verification. Attackers inject SQL payloads, path traversal sequences like ../../../../dev/null, or file URLs to force the server to sign verification with attacker-known or empty key material.

Can JWTs be extracted from mobile apps?▼

Yes, JWTs are extractable from mobile apps through Android SharedPreferences files, adb backups when allowBackup is true, iOS Keychain via jailbreak or unencrypted backups, and React Native AsyncStorage which stores tokens in plaintext. Tools include Frida, objection, and MobSF.

Why does the alg:none JWT attack work?▼

The alg:none attack works when JWT libraries disable signature verification for tokens declaring the none algorithm, including case variants like None or NONE. The attacker simply removes the signature and sets alg to none, and misconfigured servers accept the unsigned token.

What are the limitations of automated JWT scanning tools?▼

Automated tools like jwt_tool cover common misconfigurations but miss context-specific flaws such as custom claim validation logic, token binding issues, and application-level confusion between JWT and SAML or API keys. Manual testing of claims, transport, and session interaction remains necessary.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

performing-jwt-none-algorithm-attack

Forge and test JWT none-algorithm tokens to detect signature verification bypass vulnerabilities.

Community
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

testing-api-authentication-weaknesses

Test API authentication mechanisms for token validation and session flaws.

Community
Advanced
devtintdevtint

jwt-attacks

Detect and exploit JWT vulnerabilities including algorithm confusion and weak secrets.

Community
Advanced