skills.rest
xijunww
xijunwwCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

jwt-oauth-token-attacks

Detect and mitigate JWT and OAuth token vulnerabilities in web applications.

1|Updated Jun 26, 2026
Search Tags:#oauth#jwt#vulnerability assessment#web application security#token security
One-click install
npx skills add https://github.com/xijunww/Pentest --skill jwt-oauth-token-attacks-xijunww
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jwt-oauth-token-attacks
Source: https://github.com/xijunww/Pentest/tree/main/packages/core/src/config/skills/builtin/jwt-oauth-token-attacks
Command: npx skills add https://github.com/xijunww/Pentest --skill jwt-oauth-token-attacks-xijunww

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and mitigate vulnerabilities in JWT and OAuth tokens, ensuring secure authentication and authorization in web applications.

Core Features & Use Cases

  • JWT Cryptographic Attacks: Detects and mitigates attacks like 'alg:none', RS256→HS256, secret crack, kid/jku injection.
  • OAuth Flow Attacks: Identifies CSRF, open redirect, token theft, and implicit flow abuse.
  • PKCE Bypass: Detects and prevents bypassing of Proof Key for Code Exchange (PKCE).
  • Token Leakage: Identifies token leakage via Referer/logs.
  • Use Case: Use this Skill to validate token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses in your web applications.

Quick Start

Load the jwt-oauth-token-attacks skill to begin analyzing and securing your JWT and OAuth tokens.

Frequently Asked Questions about jwt-oauth-token-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect JWT vulnerabilities like alg:none or RS256 to HS256 attacks?▼

To detect JWT vulnerabilities like alg:none or RS256 to HS256 algorithm confusion, you must analyze token trust, signing algorithms, and key handling. This process identifies cryptographic attacks and ensures secure web authentication.

What is the best way to identify OAuth flow vulnerabilities in web applications?▼

Identifying OAuth flow vulnerabilities requires analyzing bearer flows and account-binding weaknesses. This technique detects CSRF, open redirect, token theft, and implicit flow abuse to secure authorization in your web applications.

How does PKCE bypass detection work for OAuth token security?▼

PKCE bypass detection works by validating the Proof Key for Code Exchange implementation within OAuth flows. This mechanism identifies and prevents bypassing of PKCE, ensuring token security against implicit flow abuse.

How do I prevent JWT and OAuth token leakage via Referer and logs?▼

Preventing JWT and OAuth token leakage via Referer and logs requires analyzing token transmission and storage paths. This process identifies potential exposure points, mitigating token theft through network traffic and system logs.

Do I need prior knowledge of OAuth protocols to assess web application security?▼

Yes, assessing web application security for token vulnerabilities requires prerequisite knowledge of JWT and OAuth protocols and their security considerations. This expertise is necessary to validate token trust and identify cryptographic attacks.

Related Skills

Explore More Software Engineering Skills→
michelvemichelve
1

route-tester

Test Express.js HTTP API routes with TypeScript across unit, integration, and end-to-end methods.

Community
Intermediate
fusenginefusengine
22

auth-audit

Audit JWT, session, and OAuth2 authentication patterns for security vulnerabilities.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
Emitax123Emitax123

jwt-security

Implement secure JWT authentication with signing algorithms and token validation.

Community
Advanced