JWT Attack Skill

Complete JWT attack methodology — decode without verification, algorithm confusion (alg:none, RS256→HS256), weak secret brute force (hashcat/john/simple), kid injection, expired token reuse, and hardcoded JWT extraction from JS bundles. Confirmed on enterprise-portal (JWT-based sessions), fintech-processor (315 JWT tokens in Efí bank logs), fitness-chain (3 JWT sessions with 2027 expiry), delivery-platform (hardcoded JWTs in JS bundles), and gov-finance-portal (JWT secret leaked in Vite source).

When to Use

• API uses Authorization: Bearer eyJ... headers.
• JavaScript bundles contain eyJ... token patterns.
• After js-secrets-extraction finds JWT tokens.
• After api-noauth-hunt needs token forging for auth bypass.
• Cookies contain jwt=, token=, or session= with base64-encoded values.

Prerequisites

• terminal with curl, python3.
• JWT token to attack (from recon).
• For brute force: hashcat or john for high-speed cracking (optional).

How to Run