skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-jwt-crypto

Detect and exploit JWT signature forgery flaws including alg:none and RS256-to-HS256 key confusion.

10|3|Updated Aug 10, 2026
Search Tags:#authentication#jwt#security testing#penetration testing#token forgery#key confusion#alg none
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-jwt-crypto-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-jwt-crypto
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-jwt-crypto
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-jwt-crypto-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Applications that authenticate with JSON Web Tokens can be compromised when the token verifier mishandles signature validation, letting an attacker forge tokens for any identity. This Skill provides a structured, evidence-gated workflow to find and prove JWT cryptographic failures during authorized security assessments. ## Core Features & Use Cases - alg:none signature stripping: Test whether the verifier trusts the token's own alg header by dropping the signature and editing identity claims, including case variants like None/NONE. - RS256 to HS256 key confusion: Re-sign an edited payload with HS256 using the server's public RSA key as the HMAC secret when the verifier accepts algorithm switching. - kid/jku/x5u header injection: Point the kid header at files like /dev/null for empty-secret signing, or host a controlled JWKS for jku/x5u URL-based key fetching. - Use Case: During an authorized web assessment you capture an eyJ... Bearer token, decode it, forge an admin claim via key confusion, and prove impact by reading the admin user list or performing an admin action. ## Quick Start Use the hunt-jwt-crypto skill to test whether this application's JWT authentication can be forged via alg:none or key confusion and prove cross-identity access.

Frequently Asked Questions about hunt-jwt-crypto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a JWT for alg:none vulnerability?▼

Set the token header alg to none, remove the signature while keeping the trailing dot, and edit payload claims like role or user id. If the verifier accepts it, try case variants such as None or NONE, since some verifiers only reject lowercase none.

What is RS256 to HS256 key confusion in JWT?▼

Key confusion occurs when a verifier expecting RS256 accepts HS256 and uses the RSA public key as the HMAC secret. Since the public key is known, an attacker can sign a forged payload with HS256 using that key and pass verification.

Which tools can forge JWT tokens for security testing?▼

jwt_tool supports tampering with -T, alg:none with -X a, and key confusion with -X k -pk public.pem. Burp Suite's JWT Editor extension and a few lines of PyJWT also work, avoiding error-prone manual base64url encoding.

How does JWT kid header injection work?▼

When the verifier loads the HMAC key from a file named by the kid header, point kid at a file with known contents such as /dev/null via path traversal, then sign with an empty secret. The kid value can also carry SQLi, command injection, or SSRF if the lookup hits a database, shell, or URL.

Why does my forged JWT get a 401 response?▼

A 401 means the forge or claim is wrong, not necessarily that the app is safe. Change one variable at a time: the kid traversal depth, the claim name or value matching a real decoded token, or the algorithm, then retry the protected endpoint.

What counts as proof of impact for a JWT forgery finding?▼

Proof requires cross-identity access: reading another user's data, an account listing with multiple users' emails, or completing an admin action with the forged token. A 200 returning only your own data, or a 401, does not demonstrate impact.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

performing-jwt-none-algorithm-attack

Forge and test JWT none-algorithm tokens to detect signature verification bypass vulnerabilities.

Community
Intermediate
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
marcboggsmarcboggs

hunt-ato

Tests nine account takeover paths including password reset flaws, OAuth misconfigurations, and MFA bypass chains.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-ato

Analyze password reset flaws, MFA bypass, and session fixation for account takeover vulnerabilities.

Community
Advanced