jwt-attacks

Detect and exploit JWT vulnerabilities including algorithm confusion and weak secrets.

Updated Feb 23, 2026

Search Tags:#authentication #jwt #security testing #api security #algorithm-confusion #token-forgery

Ready to run

npx skills add https://github.com/devtint/API_PENTEST --skill jwt-attacks-devtint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jwt-attacks
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/jwt-attacks
Command: npx skills add https://github.com/devtint/API_PENTEST --skill jwt-attacks-devtint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jwt, hashcat, john, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit vulnerabilities in JSON Web Token (JWT) authentication mechanisms, preventing unauthorized access and privilege escalation.

Core Features & Use Cases

JWT Decoding & Analysis: Understand token structure, algorithms, and claims.
Vulnerability Testing: Detect weak secrets, algorithm confusion, and injection flaws.
Token Forgery: Craft malicious tokens to bypass authentication.
Use Case: When an API uses JWTs for authentication, this Skill can test for common flaws like weak secrets or algorithm confusion, allowing you to forge an admin token and gain privileged access.

Quick Start

Use the jwt-attacks skill to decode the provided JWT token and analyze its security.

Frequently Asked Questions about jwt-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test JWT authentication for algorithm confusion vulnerabilities?▼

To test JWT authentication for algorithm confusion, this Skill systematically analyzes the token structure and algorithms to detect and exploit flaws where token verification logic is misconfigured, allowing attackers to bypass intended signing methods.

What is the best way to crack weak JWT secrets from an Authorization header?▼

The best way to crack weak JWT secrets is to extract the token from the Authorization header and use hashcat or john the ripper, integrated via the jwt library, to systematically brute-force and recover the signing key.

Can I forge an admin token to bypass API security if I find a weak JWT secret?▼

Yes, you can forge an admin token to bypass API security by exploiting recovered weak secrets or algorithm confusion to tamper with claims, crafting a malicious JSON Web Token that grants privileged unauthorized access.

Do I need Python and specific cracking tools to perform JWT security testing?▼

Yes, JWT security testing requires Python 3.8+ and the jwt library for decoding and analysis, along with hashcat and john the ripper as dependencies for brute-forcing and cracking weak secrets.

How do I decode and analyze JWT claims to find injection flaws?▼

To decode and analyze JWT claims for injection flaws, this Skill parses the token structure to identify vulnerabilities in the payload, detecting tampering opportunities and weak configurations in the authentication mechanism.