jwt-oauth-token-attacks

To test JWT signature verification flaws, you execute targeted attacks checking whether the server mishandles `alg` values including `none` and if it is vulnerable to RS256→HS256 key confusion. This reveals cryptographic weaknesses in bearer-token endpoints.

Checking for OAuth redirect_uri bypass and state CSRF vulnerabilities involves validating resilience against missing or weak `state` parameters and testing redirect URI bypass patterns. This identifies authorization code and implicit flow weaknesses in modern web applications.

Token forgery via header injection works by manipulating the `kid` parameter and injecting key sources through `jku` or `x5u` headers. This tests whether the application improperly trusts attacker-controlled keys to validate forged tokens.

You can evaluate HMAC secret brute-force risks by testing the token's signature against common and weak secret dictionaries. This assesses whether the application uses predictable or low-entropy keys for JWT signing.

Testing OAuth implicit flow for token leakage and scope escalation requires validating the flow's resilience against unauthorized access and checking if manipulated requests grant elevated privileges beyond the originally authorized scopes.