api-auth-and-jwt-abuse

Name: api-auth-and-jwt-abuse
Availability: InStock
Author: doriangallo

Inspect JWT headers and claims for authentication trust weaknesses.

5|2|Updated May 16, 2026

Search Tags:#jwt #api-auth #rate limit bypass #oauth oidc #header spoofing #token triage #claim misuse

Ready to run

npx skills add https://github.com/DorianGallo/hack-skills-local --skill api-auth-and-jwt-abuse-doriangallo

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-auth-and-jwt-abuse
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/api-auth-and-jwt-abuse
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill api-auth-and-jwt-abuse-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you identify how APIs mistakenly trust JWT and bearer tokens (or related identity signals) and how that trust can be exploited via header tricks, claim misuse, or rate-limit and batching weaknesses.

Core Features & Use Cases

Token triage for JWT and API auth: Review alg, kid, jku, x5u, and security-sensitive claims (role/org/tenant/scope/privilege) to spot issuer/audience and identity reuse problems.
JWT abuse test picks: Validate common failure modes such as unsigned alg:none acceptance, RS256/HS256 confusion, untrusted kid handling, remote key fetch via jku/x5u, and weak secret cracking.
Batch and rate-limit bypass patterns: Identify abuse paths using proxy-related headers and GraphQL/JSON batching to multiply attempts within constraints.

Quick Start

Use the api-auth-and-jwt-abuse skill to triage a protected API endpoint by checking JWT header fields, sensitive claims, and then testing header spoofing and batching/rate-limit bypass behaviors against your target.

Frequently Asked Questions about api-auth-and-jwt-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test JWT claim tampering and algorithm confusion in API authentication?▼

To test JWT claim tampering and algorithm confusion, inspect header parameters like `alg` and `kid` to validate failure modes such as unsigned `alg:none` acceptance, RS256/HS256 confusion, and untrusted `kid` handling against your target API.

What are common rate limit bypass patterns for REST and GraphQL APIs?▼

Common rate limit bypass patterns for REST and GraphQL APIs involve abusing proxy-related headers and leveraging GraphQL or JSON batching to multiply attempts within existing constraints.

How does untrusted key fetch abuse work with JWTs?▼

Untrusted key fetch abuse with JWTs works by exploiting remote key fetch parameters like `jku` and `x5u` in the token header, allowing attackers to point the API to fetch cryptographic keys from an untrusted external source.

Can I use header spoofing to bypass API authentication and authorization controls?▼

Header spoofing can bypass API authentication by injecting forged proxy-related identity headers, exploiting endpoints that mistakenly trust these signals for authorization without properly validating the actual bearer tokens or JWT claims.

What sensitive JWT claims should I triage to find API trust flaws?▼

When triaging JWTs for API trust flaws, inspect security-sensitive claims including role, org, tenant, scope, and privilege fields to spot issuer or audience misuse and identity reuse problems.

Does this approach work for both REST and GraphQL endpoint security testing?▼

Yes, this approach works for both REST and GraphQL endpoint security testing, systematically identifying token trust weaknesses, header spoofing vulnerabilities, and batch or rate-limit bypass behaviors across both API architectures.