skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

testing-jwt-token-security

Test JWT tokens for algorithm confusion and authorization bypass vulnerabilities.

Updated Apr 23, 2026
Search Tags:#authorization#authentication#jwt#cryptography#pentest#security-testing
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill testing-jwt-token-security-yukiito1999
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-jwt-token-security
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/testing-jwt-token-security
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill testing-jwt-token-security-yukiito1999

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyjwt, requests, urllib3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Assessing JWT implementations for cryptographic weaknesses, algorithm confusion vulnerabilities, and authorization bypass during security engagements.

Core Features & Use Cases

  • Algorithm None and Algorithm Confusion attack testing to identify bypass opportunities.
  • HMAC brute-force and key injection analysis to evaluate signing secret strength and key handling.
  • JWKS/OpenID discovery checks and claim tampering simulations to validate server-side protections.

Quick Start

Provide a JWT token to the agent and run the tool to start automated security testing.

Frequently Asked Questions about testing-jwt-token-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test JWT tokens for algorithm confusion vulnerabilities during a pentest?▼

To test JWT algorithm confusion, provide the token to the agent to automate attacks identifying bypass opportunities in authentication flows, checking if the server improperly accepts algorithm switching to compromise authorization.

What is a JWT None algorithm attack and how can I detect it?▼

A JWT None algorithm attack removes the cryptographic signature to bypass authentication. This Skill detects it by automating token tampering simulations to validate if server-side protections correctly reject unsigned tokens.

Can I brute-force JWT signing secrets using PyJWT and network requests?▼

Yes, you can brute-force JWT signing secrets using this Skill's HMAC brute-force analysis. It leverages PyJWT and requests to evaluate signing secret strength and key handling weaknesses over network access.

How do I validate JWT revocation behavior and JWKS discovery for SSO integrations?▼

To validate JWT revocation behavior and JWKS discovery for SSO, the Skill automates JWKS and OpenID discovery checks alongside claim tampering simulations to ensure server-side protections handle token lifecycle securely.

Does this JWT security testing approach work for API security reviews?▼

Yes, this JWT security testing approach works for API security reviews. It identifies cryptographic weaknesses, key injection flaws, and authorization bypass opportunities specifically within API authentication and authorization flows.

Related Skills

Explore More Software Engineering Skills→
din4edin4e
2

offensive-jwt

Identify and exploit JWT authentication weaknesses across web and mobile targets.

Community
Intermediate
balsm-healthbalsm-health
2

testing-jwt-token-security

Test JWT tokens for cryptographic weaknesses, algorithm confusion, and authorization bypass.

Official
Advanced
jinyimeng01jinyimeng01
54

auth-bypass

Identify authentication bypass weaknesses in protected web application endpoints.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced