skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-jwt-crypto

Detect and exploit JWT signature forgery flaws including alg:none and RS256 to HS256 key confusion.

Updated Sep 6, 2026
Search Tags:#authentication#jwt#security testing#penetration testing#bug bounty#token forgery#key confusion
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-jwt-crypto-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-jwt-crypto
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-jwt-crypto
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-jwt-crypto-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Applications that authenticate with JSON Web Tokens often verify signatures incorrectly, letting an attacker forge a token for any identity. This Skill guides a security tester through finding and proving those cryptographic verification flaws during authorized bug bounty testing. ## Core Features & Use Cases - Signature-stripping attacks: Test alg:none acceptance with case variants to bypass signature verification entirely. - Key confusion and header injection: Exploit RS256 to HS256 confusion using the public key as an HMAC secret, plus kid, jku, x5u, and jwk header injection paths. - Offline secret cracking and escalation: Crack weak HS256 secrets with hashcat or jwt_tool, then escalate forged claims to reach admin endpoints and prove cross-identity data access. - Use Case: During an authorized bug bounty engagement, you capture an eyJ... Bearer token, decode it, discover RS256, fetch the public key from /.well-known/jwks.json, re-sign an edited admin payload with HS256, and demonstrate access to the admin user list. ## Quick Start Analyze this JWT from the target application and test whether I can forge an admin token using alg:none or RS256 to HS256 key confusion.

Frequently Asked Questions about hunt-jwt-crypto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a JWT for alg:none vulnerability?▼

Set the token header alg to none, remove the signature while keeping the trailing dot, and edit the payload claims such as role or sub. Send it with a tool like jwt_tool -X a or Burp JWT Editor, and try case variants like None or NONE if lowercase is rejected.

How does RS256 to HS256 key confusion work?▼

If the verifier lets the token choose HS256, it uses the RSA public key as the HMAC secret, and that key is public. Obtain it from /jwks.json or the JS bundle, then re-sign an edited payload with HS256 using that PEM as the secret via jwt_tool -X k -pk public.pem.

What tools are used for JWT attack testing?▼

jwt_tool supports tampering, alg:none, key confusion, and wordlist cracking. Burp JWT Editor handles interactive token editing, PyJWT enables scripted signing, hashcat mode 16500 cracks weak HMAC secrets, and nuclei automates JWT vulnerability scanning.

Can weak JWT secrets be cracked offline?▼

Yes, HS256 tokens signed with weak secrets can be cracked offline using hashcat mode 16500 with a wordlist like rockyou.txt, or jwt_tool -C -d wordlist.txt. Once recovered, the secret lets you forge any token.

Why does my forged JWT get a 401 response?▼

A 401 means the verifier rejected the forge, so change one variable at a time: the alg value, the kid traversal depth, or the claim name and value. Match the payload shape to a real decoded token, since an unparseable payload fails for the wrong reason.

What proves a JWT forgery vulnerability is exploitable?▼

Proof requires cross-identity impact: use the forged token to read another user's data, list multiple users' emails, or complete an admin action like deleting a user. A 200 returning only your own data, or a 401, is not valid proof.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

auth-sec

Map authentication and authorization test scope for web and API targets.

Official
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
marcboggsmarcboggs

hunt-ato

Tests nine account takeover paths including password reset flaws, OAuth misconfigurations, and MFA bypass chains.

Community
Intermediate
kaminocorpkaminocorp
1

Authentication Bypass

Detects authentication and session management vulnerabilities in application source code.

Official
Intermediate