Detect unsigned JWT tokens, header injections, and algorithm confusion.
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-jwt
Please help me install this Agent Skill. Skill: defensive-jwt Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-jwt Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-jwt
JWTs are a common attack surface; misconfigurations and weak validation enable token forgery, header injection, and token leakage. This skill helps security teams detect and triage JWT abuse in cloud and application environments.
Configure detectors to flag unsigned JWTs, JWK/JKU injection, and algorithm confusion, then apply Sigma and KQL patterns to your logs.
High-intent search queries and answers about installing and using this skill.
Detect JWT alg:none token forgery by configuring detectors to flag unsigned tokens and applying Sigma rules to your environment logs. This identifies misconfigured tokens where algorithm validation is bypassed during security operations triage.
JWK and JKU header injection works by embedding malicious public keys directly in the token header or pointing to an attacker-controlled URL. Detect this JWT attack by enforcing strict JWKS pinning and flagging external key references in your logs.
You can use KQL queries to triage JWT algorithm confusion attacks in Entra ID SigninLogs and AuditLogs. This supports SOC workflows by identifying tokens where asymmetric algorithms are improperly validated against symmetric keys.
The best way to hunt for JWT token leakage and header injection is applying Sigma and KQL patterns to your logs. Combine strict token validation checks for alg, iss, aud, and exp claims with hardening controls across identity platforms.
You need strict token validation checks to prevent algorithm confusion in JWTs. Enforcing controls for alg, iss, aud, and exp claims alongside JWKS pinning prevents attackers from manipulating token headers to bypass signature verification.
JWT token abuse occurs in API gateways and cloud apps due to misconfigurations and weak validation practices. Attackers exploit these gaps to forge tokens, inject headers, and leak credentials across Entra ID and application environments.
riparinoDetect OAuth abuse and consent-related security incidents in Entra ID environments.
yaklangRoute API security assessments to focused testing workflows based on observed indicators.
MHaggisGenerate and execute security detection test scenarios across SIEM platforms.
Prohao42Identify WAF products and apply bypass techniques for penetration testing.
