Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session mana

Testing for JSON Web Token Vulnerabilities When to Use When testing applications using JWT for authentication and session management During API security assessments where JWTs are used for authorization When evaluating OAuth 2.0 or OpenID Connect implementations using JWT During penetration testing of single sign on (SSO) systems When auditing JWT library configurations for known vulnerabilities Prerequisites jwt tool (Python JWT exploitation toolkit) Burp Suite with JWT Editor extension jwt.io for decoding and inspecting JWT structure Understanding of JWT structure (header.payload.signature) and algorithms (HS256, RS256) hashcat or john for brute forcing weak JWT secrets Python PyJWT library for custom JWT forging scripts Access to application using JWT based authentication Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws. Workflow Step 1 — Decode and Analyze JWT Structure Step 2 — Test "None" Algorithm Bypass Step 3 — Test Algorithm Confusion (RS256 to HS256) Step 4 — Test Key ID (kid) Parameter Injection Step 5 — Test JKU/X5U Header Injection Step 6 — Brute Force Weak JWT Secrets Key Concepts Concept Description Algorithm Confusion Switching from asymmetric (RS256) to symmetric (HS256) using public key as secret None Algorithm Setting alg to "none" to create unsigned tokens accepted by misconfigured servers Kid Injection Exploiting the Key ID header parameter for SQLi, path traversal, or SSRF JKU/X5U Injection Pointing key source URLs to attacker controlled servers for key substitution Weak Secret HMAC secrets that can be brute forced using dictionary attacks Claim Tampering Modifying payload claims (role, sub, admin) after bypassing signature verification Token Replay Reusing valid JWTs after the intended session should have expired Tools & Systems Tool Purpose jwt tool Comprehensive JWT testing and exploitation toolkit JWT Editor (Burp) Burp Suite extension for JWT manipulation and attack automation hashcat GPU accelerated JWT secret brute forcing (mode 16500) john the ripper CPU based JWT secret cracking jwt.io Online JWT decoder and debugger for inspection PyJWT Python library for programmatic JWT creation and verification Common Scenarios 1. None Algorithm Bypass — Change JWT algorithm to "none", remove signature, and forge admin tokens on servers that accept unsigned JWTs 2. Algorithm Confusion RCE — Switch RS256 to HS256 using leaked public key to forge arbitrary tokens for administrative access 3. Kid SQL Injection — Inject SQL payload in kid parameter to extract the signing key from the database 4. Weak Secret Cracking — Brute force HMAC SHA256 secrets using hashcat to forge arbitrary JWTs for any user 5. JKU Server Spoofing — Point JKU header to attacker controlled JWKS endpoint to sign tokens with attacker's private key Output Format

testing-for-json-web-token-vulnerabilities