jwt-attacks

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

Attacker-minded, 100% client-side JWT toolkit — decode, audit & forge tokens. Generates alg:none, key-confusion, kid-injection & brute-force attacks with ready-to-run curl/Burp/nuclei exports. The security alternative to jwt.io.

A complete bug bounty guide on Price Manipulation & Business Logic vulnerabilities — Basic to Ninja level, Attack Chaining, Mobile Testing, Bypasses, Report Templates & Checklist.

tool to test and exploit common JWT security issues such as weak signing keys, alg:none bypasses, and RS/HS confusion attacks.

A comprehensive JWT attack CLI covering every major vulnerability class — from alg:none bypass to RS256→HS256 algorithm confusion, HMAC secret bruteforce, kid header injection (SQLi + path traversal), jku/x5u spoofing with built-in JWKS server, and full token forgery. Built for bug bounty hunters and red teamers.

JWT security analysis and forgery toolkit for authorized testing

JWTMaster is a free online JWT security toolkit for decoding, analyzing, testing, modifying, signing, and verifying JSON Web Tokens. It includes JWT risk analysis, HMAC secret testing, JWK injection testing, and controlled security testing tools for penetration testers, developers, security researchers, and cybersecurity learners.

A Pokemon themed playground for learning real JWT attacks by actually doing them. Spin it up with Docker Compose and work through seven gyms, from no signature verification all the way to JWK injection and SQL injection via kid, each with hints and a built in token decoder to help you along the way.

https://github.com/systemslibrarian/crypto-lab-jwt-forge3:45 PMcrypto-lab-jwt-forge — proper order, most-specific subject first:jwtBrowser-based JWT/JWS demo — paste or generate a token, tamper with claims, swap algorithms, and watch alg:none and HS/RS key-confusion attacks succeed against a vulnerable verifier and fail against a correct one. Re