scan-fase-8

To test JWT authentication for algorithm none and signature bypass vulnerabilities, you decode token headers and payloads to identify weak signing algorithms and misconfigurations. This skill automates that decoding process to reveal attack surfaces and provides structured remediation guidance.

Yes, you can use this skill to detect Supabase service_role exposure and potential Row Level Security (RLS) bypass risks. It analyzes Supabase-backed apps by testing token handling and claim integrity to report on these specific security weaknesses.

The best way to analyze JWT claim manipulation and expiration handling is to enforce strict decoding and validation steps against the token's payload. This skill tests claim integrity and refresh flows to identify weaknesses in how token expiration is managed.

To check for kid, jwk, and jku injection vulnerabilities in JWT implementations, you analyze the token header for malicious key injection points. This skill tests these known JWT attacks alongside algorithm confusion to provide actionable remediation guidance.

Yes, JWT security testing works without needing additional dependencies or components. This skill operates independently using built-in references to decode tokens, test algorithm confusion, and report on token storage and refresh flow weaknesses.