jwt-oauth-token-attacks

What problem does it solve?

This Skill helps you assess whether JWT and OAuth 2.0 token validation is implemented safely by systematically testing signature handling, algorithm/key confusion, claim abuse, and common OAuth flow weaknesses.

Core Features & Use Cases

• JWT cryptographic & algorithm attacks: Check whether the server mishandles alg values (including none) and whether it is vulnerable to RS256→HS256 key confusion.
• Token forgery & key-handling weaknesses: Test brute-force risks for HMAC secrets and header manipulation via kid, plus key-source injection via jku/x5u.
• OAuth flow exploitation checks: Validate resilience against missing/weak state (CSRF), redirect URI bypasses, implicit-flow token leakage, and scope escalation.

Quick Start

Use the jwt-oauth-token-attacks skill to generate a focused JWT and OAuth attack plan for a target application’s authentication endpoints and authorization flows.