What problem does it solve? Penetration testers need a systematic methodology to evaluate JWT-based authentication, and missing a single misconfiguration like alg:none acceptance or RS256-to-HS256 confusion can leave an application exposed to full authentication bypass. ## Core Features & Use Cases - Algorithm Attack Checklist: Covers alg:none bypass, RS256-to-HS256 confusion, and weak HMAC secret brute forcing with jwt_tool and hashcat. - Header Injection Testing: Provides concrete payloads for kid SQL injection and path traversal, jku/x5u remote JWKS injection, inline jwk injection, and JWKS cache poisoning. - Mobile and Advanced Vectors: Includes JWT extraction from Android SharedPreferences and iOS Keychain, timing attacks on HMAC comparison, and SAML/API-key/OAuth token confusion tests. - Use Case: During a web application engagement, you intercept a Bearer token, decode it, discover a kid parameter, and follow the manual testing steps to attempt path traversal via kid pointing to /dev/null, then re-sign the token with an empty secret. ## Quick Start Ask the assistant to walk through the JWT attack checklist against a captured Bearer token from the target application, starting with decoding and the alg:none test.
