testing-for-json-web-token-vulnerabilities

name	testing-for-json-web-token-vulnerabilities
description	Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
domain	cybersecurity
subdomain	web-application-security
tags	["jwt","json-web-token","algorithm-confusion","authentication-bypass","token-forgery","kid-injection","jku-attack"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Testing for JSON Web Token Vulnerabilities

When to Use

• When testing applications using JWT for authentication and session management
• During API security assessments where JWTs are used for authorization
• When evaluating OAuth 2.0 or OpenID Connect implementations using JWT
• During penetration testing of single sign-on (SSO) systems
• When auditing JWT library configurations for known vulnerabilities

How to CONFIRM a Hit (avoid false negatives)

• Positive signal: a token YOU forged (alg=none, RS256→HS256 confusion, cracked HMAC secret, or kid/jku/x5u abuse) is ACCEPTED by a protected endpoint — returns 200 plus the privileged data/action for the impersonated user. Merely decoding or modifying the token proves nothing.
• Confirm by hitting a real authz-gated route (e.g. /api/admin/*) with the forged token and verifying you receive the restricted resource, not a generic page or 401/403.
• A 200 to a public route is NOT a hit; a single 401/403 is NOT a clean negative until you have varied the attack.
• Do NOT conclude "not vulnerable" until you have tried:
  • alg none in every case: none, None, NONE, nOnE, with empty signature.
  • algorithm confusion: sign with the RSA public key (from JWKS/cert) as the HMAC secret — fetch the key correctly first.
  • weak secret: run hashcat/jwt_tool wordlists; if cracked, forge and confirm acceptance.
  • kid/jku/x5u: path traversal to an empty/known file, SQLi in kid, and pointing jku/x5u to your server.
  • claim tampering (role/sub/admin) re-signed with the recovered key, plus expired-token and post-logout replay.

Prerequisites

• jwt_tool (Python JWT exploitation toolkit)
• Burp Suite with JWT Editor extension
• jwt.io for decoding and inspecting JWT structure
• Understanding of JWT structure (header.payload.signature) and algorithms (HS256, RS256)
• hashcat or john for brute-forcing weak JWT secrets
• Python PyJWT library for custom JWT forging scripts
• Access to application using JWT-based authentication

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.