JWT and OAuth Token Attacks

Problem It Addresses

Modern web apps often use JWT and OAuth 2.0 for login state and authorization, but once a token is issued it can become an attack surface: signatures may be weakened through alg:none, RSA public keys may be misused for HMAC verification, weak secret values may be cracked, kid / jku headers may be injected, or poorly configured state, redirect_uri, nonce, and PKCE flows may enable session hijacking and token leakage.

How The Skill Works

This skill provides a token-centric attack playbook:
- JWT cryptographic attacks: check alg switching, key confusion, weak-secret cracking, and kid / jku header injection.
- OAuth / OIDC flow attacks: cover CSRF, open redirect, token theft, and implicit flow abuse.
- PKCE and token leakage: examine code / code_verifier bypass, plus token exposure via Referer, logs, and front-end routing.

It fits authorized penetration testing, red-team exercises, CTF analysis, and internal threat modeling when the goal is to break an authentication chain into inspectable items.

Boundaries And Notes

The material is attack-oriented and should be used only on clearly authorized targets; avoid interfering with real user sessions in production. When the assessment involves deeper OIDC parameters, cross-origin APIs, or enterprise SSO, pair it with oauth oidc misconfiguration, cors cross origin misconfiguration, and saml sso assertion attacks.