jwt-tool
jwt_tool.py is a toolkit for validating, forging, scanning, and tampering JWTs (JSON Web Tokens).
Details
Category: Vulnerabilities
Publisher: trickest-mhmdiaa
Created Date: 2/5/2022
Container: quay.io/trickest/jwt-tool:eb411ea
Source URL: https://github.com/ticarpi/jwt_tool
Parameters
jwt
string
requiredCommand:
- The JWT to tinker with (no need to specify if in header/cookies)bare
string
Command:
--bare
- Return TOKENS ONLYmode
string
Command:
--mode
- Scanning mode: pb = playbook audit, er = fuzz existing claims to force errors, cc = fuzz common claims, at - All Tests!sign
string
Command:
--sign
- Sign the resulting tokencrack
boolean
Command:
--crack
- Crack key for an HMAC-SHA tokenquery
string
Command:
--query
- Query a token ID against the logfile to see the details of that requesttamper
boolean
Command:
--tamper
- Tamper with the JWT contentscookies
string
Command:
--cookies
- Request cookies to send with the forged HTTP requestexploit
string
Command:
--exploit
- Exploit known vulnerabilities: a = alg:none, signature, b = blank password accepted in signature, s = spoof JWKS, k = key confusion (specify public key with -pk), i = inject inline JWKSheaders
string
Command:
--headers
- Request headers to send with the forged HTTP request (can be used multiple times for additional headers)noproxy
string
Command:
--noproxy
- Disable proxy for current requestpub-key
file
Command:
--pubkey
- Public Key for Asymmetric cryptoverbose
string
Command:
--verbose
- When parsing and printing, produce (slightly more) verbose outputjwks-url
string
Command:
--jwksurl
- URL location where you can host a spoofed JWKSjwksfile
file
Command:
--jwksfile
- JSON Web Key Store for Asymmetric cryptokey-file
file
Command:
--keyfile
- Keyfile for cracking (when signed with 'kid' attacks)postdata
string
requiredCommand:
--postdata
- Text string that contains all the data to be sent in a POST requestpriv-key
file
Command:
--privkey
- Private Key for Asymmetric cryptotarget-url
string
requiredCommand:
--targeturl
- Target URLverify-rsa
string
Command:
--verify
- Verify the RSA signature against a Public Keycanaryvalue
string
requiredCommand:
--canaryvalue
- Text string that appears in response for valid token (e.g. Welcome, ticarpi)headerclaim
string
Command:
--headerclaim
- Header claim to tamper withheadervalue
string
Command:
--headervalue
- Value (or file containing values) to inject into tampered header claiminjectclaims
string
Command:
--injectclaims
- Inject new claims and update existing claims with new valuespayloadclaim
string
Command:
--payloadclaim
- Payload claim to tamper withpayloadvalue
string
Command:
--payloadvalue
- Value (or file containing values) to inject into tampered payload claimdict-file-crack
file
Command:
--dict
- Dictionary file for cracking