jwt-attacks

To test JWT authentication vulnerabilities, follow a comprehensive methodology covering algorithm confusion, weak secret brute-force, header injection, and missing signature validation. This includes step-by-step manual testing procedures and tool recommendations for thorough analysis.

A JWT algorithm confusion attack exploits flawed implementations by manipulating the token header to alter signature verification logic, such as switching to `alg: none` or symmetric keys. Testing this involves probing the application to see if it validates tokens using insecure algorithm configurations.

You can brute force a weak JWT secret by systematically guessing predictable token signing keys. This security testing approach uses recommended tools to analyze provided tokens, potentially allowing account takeover if the application relies on weak or default secrets.

Testing JWT header injection vulnerabilities like kid, jku, and x5u involves manipulating these specific header parameters during penetration testing. The methodology covers probing these parameters to detect if the application fetches keys from untrusted sources, leading to unauthorized access.

The best way to check for missing JWT signature validation in API security is to submit modified tokens with altered payloads or stripped signatures. This manual testing step identifies whether the application processes unsigned or tampered tokens, exposing critical authentication bypass vulnerabilities.