jwt-attack

1# JWT Attack Skill
2 
3Complete JWT attack methodology — decode without verification, algorithm confusion (alg:none, RS256→HS256), weak secret brute force (hashcat/john/simple), kid injection, expired token reuse, and hardcoded JWT extraction from JS bundles. Confirmed on enterprise-portal (JWT-based sessions), fintech-processor (315 JWT tokens in Efí bank logs), fitness-chain (3 JWT sessions with 2027 expiry), delivery-platform (hardcoded JWTs in JS bundles), and gov-finance-portal (JWT secret leaked in Vite source).
4 
5## When to Use
6 
7- API uses `Authorization: Bearer eyJ...` headers.
8- JavaScript bundles contain `eyJ...` token patterns.
9- After `js-secrets-extraction` finds JWT tokens.
10- After `api-noauth-hunt` needs token forging for auth bypass.
11- Cookies contain `jwt=`, `token=`, or `session=` with base64-encoded values.
12 
13## Prerequisites
14 
15- `terminal` with curl, python3.
16- JWT token to attack (from recon).
17- For brute force: `hashcat` or `john` for high-speed cracking (optional).
18 
19## How to Run
20 
21```bash
22# Decode JWT without verification
23echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" | python3 -c "
24import sys, base64, json
25parts = sys.stdin.read().strip().split('.')
26if len(parts) == 3:
27    for i, part in enumerate(parts[:2]):
28        try:
29            padded = part + '=' * (4 - len(part) % 4)
30            decoded = base64.urlsafe_b64decode(padded)
31            print(f'--- Part {i} ---')
32…