ticarpi/jwt_tool
Jwt Tool
jwt_tool is a security testing toolkit designed for analyzing, tampering with, and auditing JSON Web Tokens to identify cryptographic vulnerabilities and implementation flaws. It serves as a comprehensive suite for security auditing and vulnerability scanning, providing a debugging interface to inspect token headers and payloads.
The project distinguishes itself through specialized capabilities for token forgery and secret cracking. It includes a token generator that signs custom tokens using RSA, ECDSA, and symmetric algorithms, and a brute force tool that uses high-speed dictionary attacks to uncover weak secret keys. It also features an automated vulnerability scanner that executes predefined playbooks against web endpoints to detect common misconfigurations.
The toolkit covers a broad range of security testing activities, including identity provider analysis via web key set discovery, token claim fuzzing, and integrity validation. It supports the transmission of modified tokens through HTTP headers and cookies to monitor server responses for successful exploitation.
The application supports containerized deployment to ensure consistent execution across different computing environments.
Features
- JWT Vulnerability Analysis - Provides a comprehensive suite for identifying vulnerabilities and misconfigurations in JSON Web Token implementations.
- Brute Force Tools - Provides a utility for cracking JSON Web Token secret keys using high-speed dictionary attacks.
- Token Forgery Exploits - Creates tokens using known vulnerabilities to bypass signature validation and gain unauthorized access.
- JWT Secret Cracking - Uses dictionary attacks and brute force to uncover weak secret keys used for signing JSON Web Tokens.
- JWT Vulnerability Scanning - Runs predefined tests and playbooks against target URLs to identify common token misconfigurations.
- Secret Key Brute-forcing - Provides high-speed dictionary attacks to uncover weak secret keys used for signing JSON Web Tokens.
- Web Vulnerability Scanners - Automates the testing of web endpoints for common JSON Web Token implementation flaws and signature bypasses.
- Multi-Algorithm Signings - Implements a common interface for signing tokens using HMAC, RSA, and ECDSA cryptographic standards.
- JWT Signing and Verification - Creates and signs custom JSON Web Tokens using RSA, ECDSA, and various symmetric algorithms.
- Token Forgery - Creates and signs modified JSON Web Tokens to bypass security controls and gain unauthorized access.
- Test-Case-Driven Vulnerability Validation - Executes a sequence of predefined test cases against target URLs to detect known token misconfigurations.
- Token Debugging Interfaces - Provides a workspace for inspecting token headers and payloads while testing against live application targets.
- Canary-Based Response Validation - Sends modified tokens via headers or cookies and validates server responses using unique canary values.
- Cryptographic Key Generation - Enables the creation of RSA and ECDSA keys for signing and forging tokens.
- Provider Security Analysis - Discovers and inspects web key sets and endpoints to analyze identity provider token verification.
- Key Reconstruction - Parses JSON Web Key Set files to extract and rebuild cryptographic keys for token forging.
- Token Claim Fuzzing - Injects custom values into headers and claims to identify injection vulnerabilities or force application errors.
- Token Processing Misconfigurations - Runs automated playbooks against live applications to identify security flaws in token processing.
- Provider Endpoint Discovery Mechanisms - Scans common URL paths to discover web key sets used for token verification in identity providers.
- Token Validation - Checks token validity and tests for signature bypasses, key injection, and public key mismatches.
- Token Signing Operations - Generates valid token signatures using provided secrets or private keys across multiple algorithms.
- Token Content Tampering - Creates new tokens by tampering with headers, payloads, or timestamps and signing them with a provided key.
- Token Transmission Testing - Sends modified tokens to web services via headers or cookies and verifies results using canary values.
- Token Exploitation Testing - Allows sending modified tokens to a target URL via HTTP requests to monitor responses for successful exploitation.
