Testing playbook · intermediate

JWT Attacks

Forge or tamper JSON Web Tokens by abusing weak verification.

jwtauthcrypto

Stable IDplaybook:jwt-attacksLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated workflow

Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

Decode & inspect

Read the header and claims. Note the alg, kid, and any user/role fields. Never trust client-side; the server's verification is the target.

python3 jwt_tool.py <token>

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Try alg:none (unsigned) and RS256→HS256 key confusion (sign with the public key as HMAC secret).

python3 jwt_tool.py <token> -X a

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

For HS256, brute-force the signing secret offline with a wordlist. Weak secrets are common in dev-leaked configs.

python3 jwt_tool.py <token> -C -d rockyou.txt

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Test path traversal or SQLi in kid, and attacker-controlled jku/x5u URLs pointing to your own key.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Field notes

Tamper a claim (role:admin) and re-sign to prove impact once you have a bypass.
Check for JWTs in cookies, Authorization headers, and WebSocket handshakes alike.

Related tools

Sources

Version history: normalized permanent page created 2026-08-20.