crypto-recon-jwt-oauth

name	crypto-recon-jwt-oauth
description	Specialist agent for detecting JWT, OAuth, session tokens, and all token-based authentication patterns in downloaded JS files. Part of crypto-recon pipeline.

Crypto Recon — JWT / OAuth / Token Specialist

Companion Files

• jwt-patterns.md — JWT structure, creation, parsing, algorithm variants (HS/RS/ES), TOTP, secret extraction, Python reconstruction
• oauth-flows.md — OAuth2 grant types (code, PKCE, client credentials, password), custom auth systems, token storage, refresh flow, session_key-as-signing-key pattern

Purpose

Find every token-based authentication mechanism: JWT creation/parsing, OAuth flows, session tokens, refresh tokens, Bearer tokens, and custom token schemes. Document structure, signing algorithm, and verification logic.

Complete Pattern Checklist

JWT (JSON Web Token)

jwt.sign(, jwt.verify(, jwt.decode(
jsonwebtoken
jose.JWT.sign(, jose.JWT.verify(
jose.jws.sign(
new SignJWT(, new EncryptJWT(
jwtDecode(, jwt_decode(

Manual JWT construction:
btoa(JSON.stringify({alg:      ← header construction
btoa(JSON.stringify({sub:      ← payload construction
.split('.')[0], .split('.')[1]  ← JWT parsing (header.payload.sig)
.split('.')[2]                  ← extracting signature

JWT header patterns:
{"alg":"HS256","typ":"JWT"}
{"alg":"RS256","typ":"JWT"}
{"alg":"ES256","typ":"JWT"}
{"alg":"none","typ":"JWT"}     ← SECURITY FLAW: alg=none

JWT algorithms:
HS256, HS384, HS512
RS256, RS384, RS512
ES256, ES384, ES512
PS256, PS384, PS512
EdDSA
none                           ← flag as critical vulnerability

OAuth

oauth.authorize(
oauth.getToken(
client_id, client_secret        ← hardcoded OAuth credentials
grant_type: 'authorization_code'
grant_type: 'client_credentials'
grant_type: 'password'
refresh_token:
access_token:
OAuth1.0:
  oauth_consumer_key
  oauth_signature_method
  oauth_signature
  oauth_timestamp
  oauth_nonce
  oauth_version

Bearer / Authorization Header

Authorization: Bearer
Authorization: Token
Authorization: Basic
headers['Authorization'] = `Bearer ${
headers.Authorization = 'Bearer '
'Bearer ' + token
'Token ' + token
btoa(username + ':' + password)  ← HTTP Basic Auth

Session / Refresh Token Patterns

localStorage.getItem('token'
localStorage.setItem('token'
localStorage.getItem('access_token'
sessionStorage.getItem('token'
Cookies.get('token'
document.cookie.*token
refreshToken(
getRefreshToken(
useRefreshToken(
token_expiry, expires_in, exp:   ← token expiration

Custom Token Schemes

X-Token:, X-Auth-Token:, X-Access-Token:
X-Api-Key:, X-API-Key:
api_key:, apiKey:, api_token:
function generateToken(
function createToken(
function buildToken(

TOTP / HOTP (2FA)

totp.generate(, hotp.generate(
otplib, speakeasy, totp
base32.*secret
TOTP, HOTP, OTP

Analysis Steps Per Finding

JWT Analysis

1. Find JWT signing — what algorithm and secret?

   jwt.sign(payload, SECRET, {algorithm: 'HS256'})
   // → SECRET is the signing key — extract if hardcoded
   

2. Find JWT verification — is alg=none accepted? (critical vuln)

3. Decode JWT payload structure — what claims are included?

   • Standard: sub, iat, exp, iss, aud
   • Custom: userId, role, sessionId, etc.

4. Find JWT extraction — where is token stored and how retrieved?

   localStorage.getItem('jwt')
   document.cookie
   

5. Token refresh flow — how does the app refresh expired tokens?

OAuth Analysis

1. Find client credentials — client_id, client_secret — are they hardcoded?
2. Identify OAuth flow — authorization code? implicit? client credentials?
3. Map redirect URLs — redirect_uri parameter
4. Find state parameter usage — CSRF protection?

Custom Token Analysis

1. Reverse the token format:

   • Split by . or - or _
   • Check if parts are Base64 (decode each)
   • Check if parts are hex (decode)
   • Identify any JSON payload inside

2. Find generation logic — how is the custom token built?

Security Flags

Pattern	Flag
alg: 'none' accepted	CRITICAL: JWT none algorithm bypass
JWT secret hardcoded in JS	CRITICAL: Extract key verbatim
client_secret in JS	CRITICAL: OAuth secret exposure
Token in localStorage	MEDIUM: XSS can steal tokens
No token expiry	MEDIUM: Infinite validity
HTTP Basic Auth with hardcoded creds	CRITICAL
Short token expiry without refresh	LOW

Output Format

JWT / TOKEN FINDINGS
====================

[J1] JWT HS256 — HIGH
  File:      common.modules-6d4292d1.js
  Line:      5501
  Operation: jwt.sign (create)
  Algorithm: HS256
  Secret:    HARDCODED: "my_super_secret_jwt_key_2024"
  Payload:   { userId, role, exp: now+86400 }
  Stored:    localStorage.setItem('token', jwt)
  Sent as:   Authorization: Bearer {jwt}
  Callers:   loginSuccess:8901
  Notes:     Secret is hardcoded. Anyone can forge tokens.
  Secret value: "my_super_secret_jwt_key_2024"

[J2] Manual Base64 JWT — MEDIUM
  File:      index-5ef15b56.js
  Line:      3301
  Operation: Manual JWT parse (no library)
  Pattern:   token.split('.')[1] → atob() → JSON.parse()
  Usage:     Extract userId and role from JWT payload
  Notes:     App trusts JWT payload client-side without verification
  Callers:   getUserRole:3400, checkPermission:3450

[J3] OAuth2 Client Credentials — HIGH
  File:      page-login-abc123.js
  Line:      901
  client_id:     HARDCODED: "target_app_client_id"
  client_secret: HARDCODED: "9a7b3c2d1e0f4g5h"
  grant_type:    client_credentials
  Notes:         Both OAuth credentials exposed in JS