performing-jwt-none-algorithm-attack

Capture a valid JWT from the target application, then use the forge command to generate none-algorithm variants with modified claims. Send each forged token to a protected endpoint and check whether any variant returns a 200 status, which indicates the server skips signature verification.

The none algorithm attack exploits JWT libraries that accept tokens with the alg header set to none, treating them as valid without verifying any signature. Attackers can forge tokens with arbitrary claims like admin roles or other users' identities.

You need Python 3.8+ with the standard base64, json, and hmac libraries, plus the requests package for live endpoint testing. Burp Suite or mitmproxy is recommended for intercepting the original token from HTTP traffic.

Yes, the confuse command tests algorithm confusion by re-signing the token with HS256 using the server's RSA public key as the HMAC secret. You must supply the public key file, which is often publicly available from JWKS endpoints.

Properly configured JWT libraries reject none-algorithm tokens when verification specifies an explicit algorithm allowlist, such as algorithms=["HS256"] in PyJWT. Case-variant bypasses also fail when libraries normalize and strictly validate the alg header.

Only on systems you own or have explicit written authorization to test. The skill includes a legal notice stating that unauthorized use against systems without permission is illegal and may violate computer fraud laws.