jwt_tool is a security testing toolkit designed for analyzing, tampering with, and auditing JSON Web Tokens to identify cryptographic vulnerabilities and implementation flaws. It serves as a comprehensive suite for security auditing and vulnerability scanning, providing a debugging interface to inspect token headers and payloads.
The project distinguishes itself through specialized capabilities for token forgery and secret cracking. It includes a token generator that signs custom tokens using RSA, ECDSA, and symmetric algorithms, and a brute force tool that uses high-speed dictionary attacks to uncover weak secret keys. It also features an automated vulnerability scanner that executes predefined playbooks against web endpoints to detect common misconfigurations.
The toolkit covers a broad range of security testing activities, including identity provider analysis via web key set discovery, token claim fuzzing, and integrity validation. It supports the transmission of modified tokens through HTTP headers and cookies to monitor server responses for successful exploitation.
The application supports containerized deployment to ensure consistent execution across different computing environments.