skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

offensive-jwt

Tests JWT implementations for algorithm confusion, weak secrets, and header injection vulnerabilities.

Updated Jun 26, 2026
Search Tags:#jwt#penetration testing#web security#token security#authentication bypass#algorithm confusion#jwt_tool
One-click install
npx skills add https://github.com/brukal001/brukal --skill offensive-jwt-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-jwt
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/auth/offensive-jwt
Command: npx skills add https://github.com/brukal001/brukal --skill offensive-jwt-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Penetration testers need a systematic methodology to evaluate JWT-based authentication, and ad-hoc testing often misses critical attack surfaces like algorithm confusion, kid injection, and JWKS poisoning. ## Core Features & Use Cases - Algorithm Attack Coverage: Step-by-step procedures for alg:none bypass, RS256-to-HS256 confusion, and HMAC secret brute forcing with jwt_tool and hashcat. - Header Injection Testing: Payloads and techniques for kid SQL injection and path traversal, jku/x5u/jwk injection, and JWKS cache poisoning. - Mobile Token Extraction: Commands for pulling JWTs from Android SharedPreferences, iOS Keychain, and React Native AsyncStorage using adb, Frida, and objection. - Use Case: During a web app engagement, you intercept an RS256-signed JWT in the Authorization header. Follow the checklist to test algorithm confusion by re-signing the token with the server's public key as an HMAC secret, then escalate to kid injection if that fails. ## Quick Start Ask the AI to walk through the JWT attack checklist against a captured Bearer token from your authorized penetration test target.

Frequently Asked Questions about offensive-jwt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a JWT for algorithm confusion attacks?▼

Algorithm confusion testing switches the token's alg header from RS256 to HS256 and re-signs it using the server's RSA public key as the HMAC secret. If the server uses the public key for verification regardless of algorithm, the forged token is accepted.

How to brute force a weak JWT HMAC secret?▼

Brute forcing HMAC secrets uses jwt_tool with the -C flag and a wordlist, or hashcat for faster cracking. Run python3 jwt_tool.py <token> -C -d wordlist.txt to test whether HS256 tokens use guessable signing keys.

What is kid parameter injection in JWT attacks?▼

kid injection exploits the key ID header parameter to trigger SQL injection or path traversal during key lookup. Payloads like ../../dev/null or ' OR 1=1 -- in the kid field can force the server to verify signatures with attacker-known values.

Can I extract JWTs from Android and iOS mobile apps?▼

Mobile JWT extraction reads tokens from Android SharedPreferences via adb, iOS Keychain via backups or Keychain-Dumper, and React Native AsyncStorage which stores data unencrypted. Tools like Frida, objection, and MobSF automate the extraction.

Why does the alg:none JWT attack fail on some servers?▼

The alg:none attack fails when libraries properly reject unsigned tokens or when servers pin the expected algorithm per issuer. Try case variants like None or nOnE, but modern libraries following current RFC guidance disable the none algorithm by default.

What tools automate JWT vulnerability scanning?▼

jwt_tool provides full scans with -M all and targeted attacks via -X flags, while Burp Suite's JWT Editor extension handles token manipulation in intercepted traffic. c-jwt-cracker offers high-speed HMAC brute forcing in C.

Related Skills

Explore More Software Engineering Skills→
mccleod1290mccleod1290
1

session-type-analysis

Classify how a web application establishes session identity from cookies, headers, and HAR traffic.

Community
Intermediate
lycheer1126lycheer1126
2

report-agent

Converts triage-approved security findings into HackerOne-format reports with CVSS scoring.

Community
Intermediate
uphiagouphiago
1.1k

okta-attack

Test Okta identity provider security with red-team attack techniques.

Community
Advanced
Q16GQ16G
83

graybox-p0

Orchestrate gray-box testing by combining white-box candidate discovery with black-box request validation.

Community
Intermediate