JWT attacks
The payload is a claim list. The header is the attack. Verify what the server actually verifies: alg, kid, jku, and whether role or tenant claims are trusted unsigned.
Skill: Session, cookies, and passkeys
Ask: Which cookie or token does the server trust, and can recovery issue a session the primary login would not?
Stop: You can name the cookie or token, the recovery path, and whether a second browser still holds a session after logout.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
- JWT / session tokens - The payload is a claim list. The header is the attack. Verify what the server actually verifies.
Disclosures
No public card yet.
Playbooks
- JWT Attacks - Forge or tamper JSON Web Tokens by abusing weak verification.
Tools
- Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
Payloads
- JWT Attacks - Probe weak verification. Confirm with jwt_tool. Try alg:none, RS256→HS256 key confusion, and kid path/SQL injection; crack HS256 secrets offline.
Bypasses
- JWT header / key tricks - The payload is a distraction. The header is the attack: alg, kid, jku, x5u, and whether the server fetches a key you control.
Questions
Is alg none still real?
On some libraries, yes. The server must accept the token, not just decode it. Prove a privileged claim change on an account you own.
Where do I look first?
alg, kid, jku/x5u, then email_verified / role / tenant_id. Refresh-token logout is a separate session bug.
This page is the linked pack hunt_brief("jwt") returns on the MCP connector. Authorized testing only.