jwt_tool
Tampers and re-signs JWTs; tests weak secrets and algorithm confusion.
A Swiss-army knife for JSON Web Tokens: decode, tamper and re-sign tokens, test the alg:none attack, RS256→HS256 algorithm confusion and other flaws. With a leaked HMAC key it forges arbitrary tokens (e.g. set is_admin:true).
Family Web exploitation
Flags -T -S hs256 -p -X
Concepts JWT Attacks, JWT Forgery (Leaked Secret), JWT Forgery (Embedded JWK, Weak RSA)
Cheatsheet JWT (JSON Web Tokens)
Installation
pipx install jwt-toolUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.