Strix•JWT 身份认证测试

Name: Strix•JWT 身份认证测试
Availability: InStock
Author: asdfgh1445

Detect JWT and OIDC signature validation, header manipulation, and key fetching flaws.

735|96|Updated Apr 23, 2026

Search Tags:#authorization #security #authentication #vulnerability #jwt #penetration testing #oidc

Ready to run

npx skills add https://github.com/asdfgh1445/ctf-super-hub --skill strix-jwt

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Strix•JWT 身份认证测试
Source: https://github.com/asdfgh1445/ctf-super-hub/tree/main/strix-authentication-jwt
Command: npx skills add https://github.com/asdfgh1445/ctf-super-hub --skill strix-jwt

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables security testers and developers to analyze and identify vulnerabilities in JWT/OIDC authentication systems, preventing token forgery and misuse.

Core Features & Use Cases

Vulnerability Detection: Detect signature validation issues such as algorithm confusion, header injection, and key fetch flaws.
Security Testing: Assess token claims, headers, and verification endpoints for common misconfigurations.
Use Case: A security analyst tests a web application's OAuth2 setup by crafting tokens with manipulated headers to verify verification robustness.

Quick Start

Use the JWT security testing skill to analyze sample tokens or verify a new OAuth2 service for vulnerabilities.

Frequently Asked Questions about Strix•JWT 身份认证测试

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for JWT signature validation vulnerabilities like algorithm confusion?▼

To test JWT signature validation, you analyze token headers and signatures to detect algorithm confusion and header injection flaws. This Skill assists by evaluating verification endpoints to identify misconfigurations that allow token forgery and misuse.

What are common security flaws in OIDC implementations?▼

Common OIDC security flaws include key fetching issues, header manipulation vulnerabilities, and token claim misconfigurations. This Skill detects these vulnerabilities by assessing token claims, headers, and verification endpoints across web and API services.

Can I use this to check my OAuth2 setup for token forgery risks?▼

Yes, you can verify a new OAuth2 service for token forgery risks by crafting tokens with manipulated headers. This approach tests the robustness of your verification endpoints and identifies signature validation weaknesses.

How does header manipulation expose JWT authentication vulnerabilities?▼

Header manipulation exposes JWT vulnerabilities by altering the token structure to bypass signature verification or inject malicious keys. This Skill identifies such flaws by testing how web and API services process manipulated token headers.

What is the best way to detect key fetching flaws in JWT implementations?▼

The best way to detect key fetching flaws is to analyze how verification endpoints retrieve and validate cryptographic keys. This Skill assesses token headers and verification endpoints to pinpoint key fetching security issues.