offensive-jwt

To test JWT authentication for algorithm confusion vulnerabilities, you simulate attacks by altering the token header from RS256 to HS256 to exploit key mismatch. This Skill automates algorithm confusion detection alongside weak HMAC secret cracking to verify token validation logic flaws.

JWT header parameter injection attacks target the kid, jku, jwk, and x5u parameters to manipulate key resolution or inject cache-poisoning payloads. This Skill systematically tests these header vectors to assess whether your token validation implementation trusts attacker-controlled key references.

Exploiting weak HMAC secrets in JWT tokens involves brute-forcing or dictionary-attacking the signature to recover the signing key. This Skill performs weak HMAC secret detection to verify if your application accepts tokens signed with easily guessable keys.

Yes, you can test mobile app JWT storage exposure during a pentest. This Skill assesses how tokens are stored on mobile platforms and verifies if they are accessible to unauthorized applications, simulating real-world attacker scenarios for token theft.

Yes, this Skill works with JWKS endpoint vulnerabilities by testing jku, x5u, and jwk header parameters. It verifies whether token validation logic fetches keys from attacker-controlled URLs, enabling cache-poisoning and key-injection attack simulations.

The best way to generate remediation guidance after finding JWT weaknesses is to validate configuration correctness and assess token validation logic. This Skill outputs actionable remediation steps based on the specific algorithm confusion or storage exposure vulnerabilities discovered.