ticarpi/jwt_tool

Features

• JWT Vulnerability Analysis - Provides a comprehensive suite for identifying vulnerabilities and misconfigurations in JSON Web Token implementations.
• Brute Force Tools - Provides a utility for cracking JSON Web Token secret keys using high-speed dictionary attacks.
• Token Forgery Exploits - Creates tokens using known vulnerabilities to bypass signature validation and gain unauthorized access.
• JWT Secret Cracking - Uses dictionary attacks and brute force to uncover weak secret keys used for signing JSON Web Tokens.
• JWT Vulnerability Scanning - Runs predefined tests and playbooks against target URLs to identify common token misconfigurations.
• Secret Key Brute-forcing - Provides high-speed dictionary attacks to uncover weak secret keys used for signing JSON Web Tokens.
• Web Vulnerability Scanners - Automates the testing of web endpoints for common JSON Web Token implementation flaws and signature bypasses.
• Multi-Algorithm Signings - Implements a common interface for signing tokens using HMAC, RSA, and ECDSA cryptographic standards.
• JWT Signing and Verification - Creates and signs custom JSON Web Tokens using RSA, ECDSA, and various symmetric algorithms.
• Token Forgery - Creates and signs modified JSON Web Tokens to bypass security controls and gain unauthorized access.
• Test-Case-Driven Vulnerability Validation - Executes a sequence of predefined test cases against target URLs to detect known token misconfigurations.
• Token Debugging Interfaces - Provides a workspace for inspecting token headers and payloads while testing against live application targets.
• Canary-Based Response Validation - Sends modified tokens via headers or cookies and validates server responses using unique canary values.
• Cryptographic Key Generation - Enables the creation of RSA and ECDSA keys for signing and forging tokens.
• Provider Security Analysis - Discovers and inspects web key sets and endpoints to analyze identity provider token verification.
• Key Reconstruction - Parses JSON Web Key Set files to extract and rebuild cryptographic keys for token forging.
• Token Claim Fuzzing - Injects custom values into headers and claims to identify injection vulnerabilities or force application errors.
• Token Processing Misconfigurations - Runs automated playbooks against live applications to identify security flaws in token processing.
• Provider Endpoint Discovery Mechanisms - Scans common URL paths to discover web key sets used for token verification in identity providers.
• Token Validation - Checks token validity and tests for signature bypasses, key injection, and public key mismatches.
• Token Signing Operations - Generates valid token signatures using provided secrets or private keys across multiple algorithms.
• Token Content Tampering - Creates new tokens by tampering with headers, payloads, or timestamps and signing them with a provided key.
• Token Transmission Testing - Sends modified tokens to web services via headers or cookies and verifies results using canary values.
• Token Exploitation Testing - Allows sending modified tokens to a target URL via HTTP requests to monitor responses for successful exploitation.

Star history