hunt-jwt-crypto

Set the token header alg value to none, edit the payload claims such as role or user id, and drop the signature while keeping the trailing dot. Some verifiers reject lowercase none but accept case variants like None or NONE, so try each variant.

When a token is signed with RS256, the RSA public key is public by design. If the verifier accepts HS256, it uses that public key as the HMAC secret, so an attacker can sign an edited payload with HS256 using the public key and pass verification.

jwt_tool supports tampering, alg:none attacks, and key confusion via flags like -X a and -X k -pk. Burp Suite's JWT Editor extension and PyJWT also work, and nuclei can automate JWT vulnerability scanning against a target URL.

Yes, HS256 tokens with weak secrets can be cracked offline using hashcat mode 16500 with a wordlist like rockyou.txt, or jwt_tool's built-in cracking mode. Once the secret is recovered, any token can be forged with HS256.

A 401 means the verifier rejected the forge, so change one variable at a time: the kid traversal depth, the claim name or value, or the algorithm. A rejected alg:none only means that specific flaw is patched, so try key confusion before concluding the app is safe.

This testing is only appropriate for authorized bug-hunting and red-team engagements within scope. It focuses on signature and crypto forgery; SSO/SAML token trust issues and non-crypto JWT handling belong to separate authentication testing areas.