name: jwtXploiter
version: 1.0
homepage: https://githbub.com/DontPanicO/jwtXploiter
wiki: https://githbub.com/DontPanicO/jwtXploiter/wiki
download: https://github.com/DontPanicO/jwtXploiter/releases/tag/v1.0
download: https://pypi.org/project/jwtxploiter/
author: DontPanicO
licence: GPL-3.0
description: A command line interface to test security of JWTs against all known CVEs and more
- Tamper with the token payload, change claims and subclaims values.
- Exploit known vulnerable header claims (kid, jku, x5u)
- Verify a token
- Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only
- All JWAs supported (HS*, RS*, PS*, ES*)
- Generates a JWK and insert it in the token header
- And much, much more!
dependencies: python3 (3.7 or newer)
python dependencies: cryptography==3.2.1
activity: actively mantained
installation: pip install, rpm package (provided by latest release on github)
how to use: this tool cover a lot of use cases, and all are well explained in the wiki. Here i just provide some basic.
- jwtxpl <token> -d # decode a token
- jwtxpl <token> -a None -p <claim_name>:<new_value> # Try alg none and change a payload claim issuing new_value
- jwtxpl <token> -a hs256 -p user:admin -k /path/to/key # Use JWA HS256, change payload, and sign token with a key
- jwtxpl <token> -a hs256 -p user:admin --unverified # Try to reuse original signature
- jwtxpl <token> -a hs256 --inject-kid sqli # Try an sqli payload against the kid header
- jwtxpl <token> -a rs256 --jku-basic <yourURL> # Try to make the jku pointing to your jwks (automatically generated)
- jwtxpl <token> -a es384 -V /path/to/key # Verify the signature using JWA ES384 and the key passed to -V
packaged: The tool has not a .deb yet, but i'm working on it. | 
