jwt-tool

jwt_tool.py is a toolkit for validating, forging, scanning, and tampering JWTs (JSON Web Tokens).

Name:jwt-tool

Category:Vulnerabilities

Publisher:trickest-mhmdiaa

Created:2/5/2022

Container:quay.io/trickest/jwt-tool:eb411ea

Output Type:

License:Unknown

Source:View Source

Parameters

jwt · string · required

The JWT to tinker with (no need to specify if in header/cookies)

bare · string

--bareReturn TOKENS ONLY

mode · string

--modeScanning mode: pb = playbook audit, er = fuzz existing claims to force errors, cc = fuzz common claims, at - All Tests!

sign · string

--signSign the resulting token

crack · boolean

--crackCrack key for an HMAC-SHA token

query · string

--queryQuery a token ID against the logfile to see the details of that request

tamper · boolean

--tamperTamper with the JWT contents

cookies · string

--cookiesRequest cookies to send with the forged HTTP request

exploit · string

--exploitExploit known vulnerabilities: a = alg:none, signature, b = blank password accepted in signature, s = spoof JWKS, k = key confusion (specify public key with -pk), i = inject inline JWKS

headers · string

--headersRequest headers to send with the forged HTTP request (can be used multiple times for additional headers)

noproxy · string

--noproxyDisable proxy for current request

pub-key · file

--pubkeyPublic Key for Asymmetric crypto

verbose · string

--verboseWhen parsing and printing, produce (slightly more) verbose output

jwks-url · string

--jwksurlURL location where you can host a spoofed JWKS

jwksfile · file

--jwksfileJSON Web Key Store for Asymmetric crypto

key-file · file

--keyfileKeyfile for cracking (when signed with 'kid' attacks)

postdata · string · required

--postdataText string that contains all the data to be sent in a POST request

priv-key · file

--privkeyPrivate Key for Asymmetric crypto

target-url · string · required

--targeturlTarget URL

verify-rsa · string

--verifyVerify the RSA signature against a Public Key

canaryvalue · string · required

--canaryvalueText string that appears in response for valid token (e.g. Welcome, ticarpi)

headerclaim · string

--headerclaimHeader claim to tamper with

headervalue · string

--headervalueValue (or file containing values) to inject into tampered header claim

injectclaims · string

--injectclaimsInject new claims and update existing claims with new values

payloadclaim · string

--payloadclaimPayload claim to tamper with

payloadvalue · string

--payloadvalueValue (or file containing values) to inject into tampered payload claim

dict-file-crack · file

--dictDictionary file for cracking