Identify and exploit JWT authentication weaknesses across web and mobile targets.
npx skills add https://github.com/din4e/Skills4RedTeam --skill offensive-jwt-din4e
Please help me install this Agent Skill. Skill: offensive-jwt Source: https://github.com/din4e/Skills4RedTeam/tree/main/skills/offensive-jwt Command: npx skills add https://github.com/din4e/Skills4RedTeam --skill offensive-jwt-din4e
JWT-based authentication systems are frequently insecure due to misconfigurations and implementation flaws. This skill provides a comprehensive methodology to identify and exploit weaknesses, enabling defenders to validate and harden token handling in web and mobile apps.
Begin by locating JWT usage in the target application and apply the listed techniques to test token validation and replay protections.
High-intent search queries and answers about installing and using this skill.
JWT algorithm confusion testing detects bypasses like alg:none or RS256/HS256 key mixing. You apply structured checks to identify improper token validation and harden authentication on target APIs.
JWT header injection testing targets the kid, jku, jwk, and x5u fields. Manipulating these parameters exposes server-side trust issues and JWKS cache poisoning risks.
Weak HMAC secret brute-forcing assesses token resilience against guessable keys. You test token signatures to validate if applications enforce strong secret policies.
JWT security testing evaluates mobile platform token storage risks and session binding issues. It validates whether mobile targets expose reusable credentials insecurely.
JWS/JWE confusion testing identifies improper handling of signed versus encrypted tokens. You test server endpoints to see if encrypted tokens bypass signature validation logic.
Authorized JWT testing minimizes data exposure by validating server-side protections without leaking secrets. You must ensure scope authorization before applying replay or timing attacks.
YukiIto1999Test JWT endpoints for signature verification gaps using the none algorithm.
ersinkocDetect JWT implementation flaws across codebases and validate algorithm handling, secret strength, and claims.
RifteoAutomate JWT token testing and cracking to uncover vulnerabilities.
kristovatlasAnalyze authentication and authorization code for misconfigurations and non-compliance.
