jwt-oauth-token-attacks

Test JWT and OAuth token validation for signature and flow weaknesses.

2|Updated May 15, 2026

Search Tags:#jwt #security testing #oauth2 #token forgery #redirect_uri #signature bypass #auth vulnerability

Ready to run

npx skills add https://github.com/lNwNl/Methodos --skill jwt-oauth-token-attacks

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jwt-oauth-token-attacks
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/jwt-oauth-token-attacks
Command: npx skills add https://github.com/lNwNl/Methodos --skill jwt-oauth-token-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you assess whether JWT and OAuth 2.0 token validation is implemented safely by systematically testing signature handling, algorithm/key confusion, claim abuse, and common OAuth flow weaknesses.

Core Features & Use Cases

JWT cryptographic & algorithm attacks: Check whether the server mishandles alg values (including none) and whether it is vulnerable to RS256→HS256 key confusion.
Token forgery & key-handling weaknesses: Test brute-force risks for HMAC secrets and header manipulation via kid, plus key-source injection via jku/x5u.
OAuth flow exploitation checks: Validate resilience against missing/weak state (CSRF), redirect URI bypasses, implicit-flow token leakage, and scope escalation.

Quick Start

Use the jwt-oauth-token-attacks skill to generate a focused JWT and OAuth attack plan for a target application’s authentication endpoints and authorization flows.

Frequently Asked Questions about jwt-oauth-token-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test JWT signature verification flaws like alg none and RS256 to HS256 confusion?▼

To test JWT signature verification flaws, you execute targeted attacks checking whether the server mishandles `alg` values including `none` and if it is vulnerable to RS256→HS256 key confusion. This reveals cryptographic weaknesses in bearer-token endpoints.

What is the best way to check for OAuth redirect_uri bypass and state CSRF vulnerabilities?▼

Checking for OAuth redirect_uri bypass and state CSRF vulnerabilities involves validating resilience against missing or weak `state` parameters and testing redirect URI bypass patterns. This identifies authorization code and implicit flow weaknesses in modern web applications.

How does token forgery via kid jku and x5u header injection work?▼

Token forgery via header injection works by manipulating the `kid` parameter and injecting key sources through `jku` or `x5u` headers. This tests whether the application improperly trusts attacker-controlled keys to validate forged tokens.

Can I evaluate HMAC secret brute-force risks for JWT tokens?▼

You can evaluate HMAC secret brute-force risks by testing the token's signature against common and weak secret dictionaries. This assesses whether the application uses predictable or low-entropy keys for JWT signing.

How do I test OAuth implicit flow for token leakage and scope escalation?▼

Testing OAuth implicit flow for token leakage and scope escalation requires validating the flow's resilience against unauthorized access and checking if manipulated requests grant elevated privileges beyond the originally authorized scopes.