Detect and exploit JWT vulnerabilities including algorithm confusion and weak secrets.
npx skills add https://github.com/devtint/API_PENTEST --skill jwt-attacks-devtint
Please help me install this Agent Skill. Skill: jwt-attacks Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/jwt-attacks Command: npx skills add https://github.com/devtint/API_PENTEST --skill jwt-attacks-devtint
This Skill helps identify and exploit vulnerabilities in JSON Web Token (JWT) authentication mechanisms, preventing unauthorized access and privilege escalation.
Use the jwt-attacks skill to decode the provided JWT token and analyze its security.
High-intent search queries and answers about installing and using this skill.
To test JWT authentication for algorithm confusion, this Skill systematically analyzes the token structure and algorithms to detect and exploit flaws where token verification logic is misconfigured, allowing attackers to bypass intended signing methods.
The best way to crack weak JWT secrets is to extract the token from the Authorization header and use hashcat or john the ripper, integrated via the jwt library, to systematically brute-force and recover the signing key.
Yes, you can forge an admin token to bypass API security by exploiting recovered weak secrets or algorithm confusion to tamper with claims, crafting a malicious JSON Web Token that grants privileged unauthorized access.
Yes, JWT security testing requires Python 3.8+ and the jwt library for decoding and analysis, along with hashcat and john the ripper as dependencies for brute-forcing and cracking weak secrets.
To decode and analyze JWT claims for injection flaws, this Skill parses the token structure to identify vulnerabilities in the payload, detecting tampering opportunities and weak configurations in the authentication mechanism.
alexfazioIntercept and inspect Claude Code API traffic using mitmproxy.
caidoEdit authenticated Caido HTTP requests without losing cookies or tokens.
ArianHobson333Analyze REST, GraphQL, WebSocket, and Web-LLM APIs for vulnerabilities.
Renzo-TognellaTest API authentication mechanisms for token validation and session flaws.
