Question 1

What is a JWT algorithm confusion attack?

Accepted Answer

Algorithm confusion (RS256 → HS256) exploits JWT libraries that accept any algorithm value from the token header. An attacker changes alg from RS256 to HS256 and re-signs the forged payload using HMAC-SHA256 with the RSA public key as the HMAC secret - a key the attacker already knows because it is public. The server, not enforcing its expected algorithm, accepts the forged token. JWT Arsenal provides a browser-based tool to perform this attack: https://jwtarsenal.com/exploit/algorithm-confusion

Question 2

How to exploit the JWT alg:none vulnerability?

Accepted Answer

The alg:none attack sets the JWT algorithm header to "none" and strips the signature. Vulnerable libraries accept unsigned tokens. Steps: change header alg to "none", re-encode with base64url, send with an empty signature (trailing dot) or no signature at all. Try case variants: None, NONE, nOnE. JWT Arsenal automates all four variants: https://jwtarsenal.com/exploit/alg-none

Question 3

How to forge a JWT without knowing the secret key?

Accepted Answer

Several techniques allow forging a JWT without the secret: (1) alg:none - strip the signature entirely if the server does not enforce algorithm; (2) Algorithm confusion - use the public RSA key as an HMAC secret; (3) JWK injection - embed your own public key in the JWT header; (4) JKU injection - point jku to an attacker-controlled JWKS endpoint; (5) Unverified signature - some servers decode but never verify the signature at all. JWT Arsenal covers all these attacks at https://jwtarsenal.com

Question 4

What is JWK injection in JWT?

Accepted Answer

JWK injection embeds an attacker-controlled RSA public key directly inside the JWT header under the jwk field. A vulnerable server uses the key from the header to verify the token instead of its own trusted key - effectively letting the attacker sign tokens with their own private key and supply the matching public key inline. JWT Arsenal generates and signs JWK-injected tokens in the browser: https://jwtarsenal.com/exploit/jwk-injection

Question 5

How does JKU injection work in JWT attacks?

Accepted Answer

The jku header parameter points to a JWKS (JSON Web Key Set) URL from which the server fetches the public key for verification. In JKU injection, the attacker replaces this URL with one pointing to an attacker-controlled endpoint hosting a crafted JWKS. The server fetches and trusts the attacker's key, validating tokens signed with the corresponding private key. JWT Arsenal provides a self-hosted JWKS and forges the token in the browser: https://jwtarsenal.com/exploit/jku-injection

Question 6

What is KID injection in JWT?

Accepted Answer

The kid (Key ID) header parameter tells the server which key to use for verification. When kid is passed unsanitised to a file read, database query, or URL fetch, it becomes an injection vector. Common variants: path traversal (kid: ../../dev/null to force an empty key), SQL injection (kid: ' UNION SELECT 'secret'--), and SSRF. JWT Arsenal demonstrates all KID injection variants: https://jwtarsenal.com/exploit/kid-injection

Question 7

How to recover an RSA public key from JWT tokens?

Accepted Answer

If an attacker can obtain two JWT tokens signed with the same RSA private key, they can recover the public key using a GCD (greatest common divisor) computation on the two signatures - no server access or key material required. The recovered key can then be used to perform algorithm confusion attacks. JWT Arsenal implements this recovery directly in the browser: https://jwtarsenal.com/exploit/public-key-recovery

Question 8

What is the unverified signature JWT vulnerability?

Accepted Answer

Some servers decode the JWT payload for claims (sub, role, exp) but never call the cryptographic signature verification function. Any token with a valid format is accepted regardless of signature validity. To test: modify the payload, re-encode, and send with the original signature or a random one - if the server accepts it, signature verification is missing. JWT Arsenal provides a tool to test this: https://jwtarsenal.com/exploit/unverified-signature

Question 9

What tools are available for JWT penetration testing?

Accepted Answer

JWT Arsenal (https://jwtarsenal.com) is a 100% client-side browser tool covering 7 JWT attack techniques: alg:none, algorithm confusion, JWK injection, JKU injection, KID injection, public key recovery, and unverified signature bypass. For CLI use: jwt_tool (Python), hashcat with mode 16500 for HS256 brute-force, and rsa_sign2n for public key recovery. JWT Arsenal's cheatsheet covers all CLI commands: https://jwtarsenal.com/cheatsheet

Vulnerability	Tool	Command	Notes
Weak HMAC Secret	hashcat	`hashcat -m 16500 jwt.txt /path/to/rockyou.txt`	Mode 16500 = JWT. Add -r rules/best64.rule for rule-based attack.
Weak HMAC Secret	hashcat	`hashcat -m 16500 jwt.txt -a 3 ?a?a?a?a?a?a`	Brute-force mode. Use ?a for all ASCII printable chars.
Weak HMAC Secret	john	`john --format=HMAC-SHA256 jwt.txt --wordlist=/path/to/rockyou.txt`	John the Ripper - format varies by JWT algorithm.
Weak HMAC Secret	jwt_tool	`python3 jwt_tool.py <JWT> -C -d /path/to/wordlist.txt`	-C = crack mode, -d = dictionary file.
Public Key Recovery	rsa_sign2n	`python3 jwt_forgery.py "<JWT1>" "<JWT2>"`	Requires 2 RS256 tokens from same key. Outputs candidate public keys.
Algorithm None	jwt_tool	`python3 jwt_tool.py <JWT> -X a`	-X a = alg:none exploit. Tests all casing variants.
Algorithm Confusion	jwt_tool	`python3 jwt_tool.py <JWT> -X k -pk public.pem`	Uses public.pem as HMAC secret for HS256 signing.
KID Path Traversal	jwt_tool	`python3 jwt_tool.py <JWT> -I -hc kid -hv "../../../../../../dev/null" -S hs256 -p ""`	-I = inject header claim, -hc = claim name, -hv = value.
Generic Tampering	jwt_tool	`python3 jwt_tool.py <JWT> -T`	-T = tampering mode (interactive). Good for manual claim modification.
Scan for vulnerabilities	jwt_tool	`python3 jwt_tool.py <JWT> -t https://target.com/api -rh 'Authorization: Bearer JWT' -M pb`	-M pb = playbook scan. Tests common JWT attack vectors automatically.

CLI Cheatsheet

Tool Setup

Wordlists

Tool Reference