JSON Web Token (JWT)

Tools

Online

• JSON Web Tokens - jwt.io

GitHub

• jwt_tool
• rsa_sign2n: Deriving RSA public keys from message-signature pairs

Challenges

Portswigger

• JWT authentication bypass via unverified signature
• JWT authentication bypass via flawed signature verification
• JWT authentication bypass via weak signing key
• JWT authentication bypass via JWK header injection
• JWT authentication bypass via JKU header injection
• JWT authentication bypass via KID header path traversal
• JWT authentication bypass via algorithm confusion
• JWT authentication bypass via algorithm confusion with no exposed key

Cryptohack

• CryptoHack – Crypto on the Web challenges

Resources

• JWT Vulnerabilities (Json Web Tokens) - HackTricks
• JWT attacks | Web Security Academy
• PayloadsAllTheThings/JSON Web Token