Agent skill · security · yaklang
jwt-oauth-token-attacks
JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.
Why this skill is useful
Adds detailed attack scripts and methodologies for exploiting JWT and OAuth vulnerabilities that are not commonly known.
What it needs
Requires hashcat, john, python3 installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: JWT and OAuth 2.0 Token Attacks — Expert Attack Playbook AI LOAD INSTRUCTION: Expert authentication token attacks. Covers JWT cryptographic attacks (alg:none, RS256→HS256, secret crack, kid/jku injection), OAuth flow attacks (CSRF, open redirect, token theft, implicit flow abuse), PKCE bypass, and token leakage via Referer/logs. This is critical for modern web applications. 0. RELATED ROUTING Use this file for token-centric attacks and flow abuse. Also load: oauth oidc misconfiguration for redirect URI, state, nonce, PKCE, and account-binding validation cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin saml sso assertion attacks when the target uses enterprise SSO outside OAuth/OIDC --- 1. JWT ANATOMY Decode in terminal: Common claim targets (modify to escalate): --- 2. ATTACK 1 — ALGORITHM NONE (alg:none) Server doesn't validate signature when algorithm is "none"/"None"/"NONE": Tool (jwttool): --- 3. ATTACK 2 — RS256 TO HS256 KEY CONFUSION When server uses RS256 (asymmetric — RSA private key signs, public key verifies): Server's public key is often discoverable (JWKS endpoint, /certs, source code) Attack: tell server "this is HS256" → server verifies HS256 HMAC using the public key as secret --- 4. ATTACK 3 — JWT SECRET BRUTE FORCE HMAC-based JWTs (HS256/HS384/HS512) with weak secret: Common weak secrets to test manually: --- 5. ATTACK 4 — kid (Key ID) INJECTION The kid header parameter specifies which key to use for verification. No sanitization = injection: kid SQL Injection If backend queries SQL: SELECT key FROM keys WHERE kid = 'INPUT' Result: HMAC key = 'attackercontrolledkey' → forge any payload signed with this value. kid Path Traversal (file read) Server reads /dev/null as key → empty string → sign token with empty HMAC. Server reads hostname as key → forge tokens signed with hostname string. --- 6. ATTACK 5 — jku / x5u Header Injection jku points to JSON Web Key Set URL. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/jwt-oauth-token-attacks