Offensive JWT Attack Checklist

Problem

JWT failures are not only about a misconfigured secret; they often come from how the server validates signature algorithms, header parameters, token lifecycle, and payload contents. During authorized security testing, manually tweaking captured fields can miss risks such as alg=none, RSA/HMAC confusion, or unvalidated kid, jku, jwk, and x5u parameters. This skill organizes those checks into an actionable checklist you can apply to the current target context.

How It Works

The skill is built around the RFC 7519 header.payload.signature structure. Its focus is not generic JWT generation, but negative validation of server-side acceptance behavior. Key steps include confirming whether none signatures are accepted, attempting algorithm switching between RSA and HMAC, assessing whether a weak HMAC secret is guessable, checking whether kid, jku, jwk, or x5u are accepted without validation, testing whether expired or tampered tokens are still processed, and checking whether sensitive data is stored unencrypted in the payload. The material also mentions using JWT Tool for encoding, decoding, and algorithm experiments, which helps reduce ad hoc commands into a repeatable workflow.

Boundaries And Notes

This is intended for offensive security engagements and should only be used against authorized targets. The checklist emphasizes ordered execution and tracking completed items, so a single successful test should not be treated as the full conclusion. If the target has additional gateways, signature policies, key rotation, or business risk controls, revalidate each finding in context rather than relying on one technique alone.