offensive-jwt

Identify and exploit JWT implementation weaknesses in web and mobile applications.

1|1|Updated Mar 4, 2026

Search Tags:#authentication #jwt #web-security #token #penetration-testing #jwks #jwk

Ready to run

npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill offensive-jwt

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: offensive-jwt
Source: https://github.com/erkanrzgc/cyberm4fia-scanner/tree/main/core/ai_skills/offensive-jwt
Command: npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill offensive-jwt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

JWT-based authentication often suffers from misconfigurations and weak implementation details that allow token forgery, bypass, or leakage. This skill provides a comprehensive methodology to identify and exploit these weaknesses in order to assess the security of token-based access controls.

Core Features & Use Cases

Identify algorithm-related weaknesses (alg:none, confusion between RS256/HS256) and misconfigurations in token validation.
Test header-related vulnerabilities (kid, jku, jwk, x5u) and JWKS caching risks in web/mobile apps.
Assess token handling in mobile and web clients, including storage, transmission, and validation gaps, to inform remediation.

Quick Start

Decode a sample JWT and attempt algorithm confusion, weak secret testing, and JWKS retrieval in a safe, authorized environment.

Frequently Asked Questions about offensive-jwt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is JWT algorithm confusion and how does it compromise authentication?▼

JWT algorithm confusion exploits misconfigurations in token validation, such as alg:none or RS256/HS256 mismatches, to forge tokens and bypass web API authentication security controls.

How do I test JWT header injections like jku, jwk, and kid vulnerabilities?▼

To test JWT header injections, manipulate kid, jku, jwk, and x5u parameters during penetration testing to identify JWKS caching risks and token validation flaws in web and mobile apps.

What's the best way to brute force weak JWT secrets?▼

The best way to brute force weak JWT secrets is using dedicated tooling to decode tokens and test HS256 weak secrets, ensuring you only target authorized environments for risk-aware assessment.

Do I need prior knowledge of JWKS retrieval to test token validation flaws?▼

Yes, you need prior knowledge of JWT structure, common algorithms (HS256/RS256/ES), and JWKS retrieval to effectively assess token handling, storage, and transmission gaps in mobile and web clients.

Can I assess token storage and transmission gaps in mobile apps using JWT testing?▼

Yes, you can assess token storage and transmission gaps in mobile apps by applying JWT penetration testing techniques to evaluate token handling and identify validation flaws in mobile interfaces.