vulns.cofield index
Enter
Contribute
Payload class · jwt

JWT Attacks

Probe weak verification. Confirm with jwt_tool. Try alg:none, RS256→HS256 key confusion, and kid path/SQL injection; crack HS256 secrets offline.

jwtauthcrypto
Stable IDpayload:jwtLast updatedLast verifiedLegacy review pendingProvenanceSource-linked
Context first

Use as a detection primitive

Probe weak verification. Confirm with jwt_tool. Try alg:none, RS256→HS256 key confusion, and kid path/SQL injection; crack HS256 secrets offline.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

alg: "none"  (strip signature, keep the trailing dot)
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

alg: "HS256" signed with the server's RS256 public key (key confusion)
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

kid: "../../../../dev/null"
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

kid: "key' UNION SELECT 'secret'-- -"
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

jku / x5u pointing at an attacker-hosted JWKS
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.