testing-for-json-web-token-vulnerabilities - Testing for JSON Web Token Vulnerabilities
Test JWT implementations for vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation.
Tags
Updated: 2026-09-20Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Decode and analyze JWT structure
- Test none algorithm bypass
- Test algorithm confusion
- Test key ID parameter injection
- Test JKU header injection
- Brute-force weak JWT secrets
Inputs
- JWT token
- Target application endpoint
- Public key file
- Wordlist
Outputs
- JWT security assessment report
Requirements
- Python 3
- jwt_tool
- Burp Suite with JWT Editor
- hashcat or John the Ripper
- PyJWT library