offensive-jwt

1## Overview
2 
3Comprehensive JWT attack checklist for offensive security engagements. Follow steps in order; apply each technique to the current target context and track which items have been completed.
4 
5## Quick Reference: Misconfigurations to Check
6 
7- Algorithm set to `none` — signature verification bypassed entirely
8- Algorithm switching between `RSA` and `HMAC` (confusion attack)
9- Weak or guessable HMAC secret (brute-forceable)
10- `kid`, `jku`, `jwk`, `x5u` header parameters accepted without validation
11- Expired or tampered tokens accepted by server
12- Sensitive data stored unencrypted in payload
13 
14Useful tool: [JWT Tool](https://github.com/ticarpi/jwt_tool)
15 
16## Mechanisms
17 
18JWTs (RFC 7519) consist of three Base64URL-encoded parts: `header.payload.signature`.
19 
20**Signing algorithms:**
21 
22| Algorithm | Type | Notes |
23|-----------|------|-------|
24| HS256/384/512 | Symmetric HMAC | Shared secret; confusion target |
25| RS256/384/512 | Asymmetric RSA | Public key can be misused as HMAC secret |
26| ES256/384/512 | Asymmetric ECDSA | |
27| PS256/384/512 | RSASSA-PSS | |
28| EdDSA (Ed25519/Ed448) | Asymmetric | |
29| none | Unsigned | Critically insecure |
30 
31**Additional pitfalls:**
32- JWS/JWE confusion: server accepts encrypted token (JWE) where signed (JWS) is expected, or fails open on unexpected `typ`/`cty`
33- JWKS retrieval: SSRF via `jku`/`x5u`, insecure TLS, poisoned key caching, `kid` collisions
34- Token binding (DPoP, mTLS): incorrectly implemented allows replay from other clients
35…