jwt-attacks

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

A complete bug bounty guide on Price Manipulation & Business Logic vulnerabilities — Basic to Ninja level, Attack Chaining, Mobile Testing, Bypasses, Report Templates & Checklist.

Attacker-minded, 100% client-side JWT toolkit — decode, audit & forge tokens. Generates alg:none, key-confusion, kid-injection & brute-force attacks with ready-to-run curl/Burp/nuclei exports. The security alternative to jwt.io.

A comprehensive JWT attack CLI covering every major vulnerability class — from alg:none bypass to RS256→HS256 algorithm confusion, HMAC secret bruteforce, kid header injection (SQLi + path traversal), jku/x5u spoofing with built-in JWKS server, and full token forgery. Built for bug bounty hunters and red teamers.

tool to test and exploit common JWT security issues such as weak signing keys, alg:none bypasses, and RS/HS confusion attacks.

A Pokemon themed playground for learning real JWT attacks by actually doing them. Spin it up with Docker Compose and work through seven gyms, from no signature verification all the way to JWK injection and SQL injection via kid, each with hints and a built in token decoder to help you along the way.

JWT security analysis and forgery toolkit for authorized testing

JWTMaster is a free online JWT security toolkit for decoding, analyzing, testing, modifying, signing, and verifying JSON Web Tokens. It includes JWT risk analysis, HMAC secret testing, JWK injection testing, and controlled security testing tools for penetration testers, developers, security researchers, and cybersecurity learners.

Browser-based JWT/JWS forgery lab — HS256, RS256, ES256, and alg:none side by side, with real WebCrypto signing, a verifier-policy panel that flips between correct and vulnerable, and alg:none and HS/RS key-confusion forgeries that the vulnerable verifier accepts and the correct one rejects