api-auth-and-jwt-abuse

Name: api-auth-and-jwt-abuse
Availability: InStock
Author: ok-helloworld

Identify API authentication flaws from JWT metadata and spoofable headers.

241|28|Updated May 20, 2026

Search Tags:#rate limiting #jwt #api security #token validation #claim abuse #header spoofing #graphql batching

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-auth-and-jwt-abuse-ok-helloworld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-auth-and-jwt-abuse
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/api-auth-and-jwt-abuse
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-auth-and-jwt-abuse-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you uncover authentication and authorization weaknesses caused by trusting JWT or token metadata, spoofable identity headers, and broken rate-limit or batching controls.

Core Features & Use Cases

Token trust triage: Reviews JWT fields and key metadata (alg, kid, jku/x5u, issuer/audience, privilege claims) to detect verification and boundary failures.
Header spoofing & routing abuse: Tests identity-related headers (X-Forwarded-For, X-Real-IP, Forwarded, and method/path variants) to find auth boundary bypasses and inconsistent enforcement.
Rate-limit and batch abuse: Probes quota/rate-limit weaknesses and GraphQL/JSON batch endpoints by testing mass assignment candidates and batched mutation patterns.

Quick Start

Use the api-auth-and-jwt-abuse skill to audit an API for JWT and bearer-token trust issues, including header spoofing, claim misuse, and rate-limit or batch-abuse weaknesses for your target endpoint.

Frequently Asked Questions about api-auth-and-jwt-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test JWT claim validation and token trust boundaries in my API?▼

To test JWT claim validation, audit bearer token fields including alg, kid, jku, x5u, issuer, and audience to detect verification failures. Review privilege claims and key metadata to uncover authorization weaknesses caused by trusting spoofable token metadata.

What is the best way to find API rate-limit bypass and GraphQL batch abuse vulnerabilities?▼

Find API rate-limit bypass and GraphQL batch abuse vulnerabilities by probing quota and rate-limit controls alongside GraphQL and JSON batch endpoints. Test mass assignment candidates and batched mutation patterns to identify broken batching controls.

Can I use header spoofing to bypass API authentication boundaries during security testing?▼

Test header spoofing to bypass API authentication boundaries by manipulating identity-related headers like X-Forwarded-For, X-Real-IP, and Forwarded. Explore method and path variants to find inconsistent enforcement and auth boundary bypasses caused by trusting spoofable request identity signals.

How do I audit an API for bearer token and API key authentication flaws?▼

Audit an API for bearer token and API key authentication flaws by reviewing token field triage, claim misuse, and header spoofing. Test token-associated metadata and spoofable identity signals to detect verification and boundary failures across endpoints.

When should I check JWT key metadata like jku and x5u headers for security testing?▼

Check JWT key metadata like jku and x5u headers during security testing when verifying token trust boundaries and key injection risks. Reviewing these fields alongside alg and kid parameters helps detect verification failures caused by trusting external key sources or manipulated algorithms.