{"id":13806407,"url":"https://github.com/DontPanicO/jwtXploiter","last_synced_at":"2025-05-13T21:33:04.561Z","repository":{"id":54161482,"uuid":"313020510","full_name":"DontPanicO/jwtXploiter","owner":"DontPanicO","description":"A tool to test security of json web token","archived":false,"fork":false,"pushed_at":"2021-03-12T13:28:11.000Z","size":368,"stargazers_count":271,"open_issues_count":0,"forks_count":33,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-11-16T20:06:59.008Z","etag":null,"topics":["ctf","ctf-tools","jku","jsonwebtoken","jwks","jwt","jwt-cracker","jwt-exploit","jwt-security","penetration-testing","penetration-testing-tools","pentest","pentest-tool","pentesting","pentesting-tools","security","security-tools","websecurity","x5u-injection"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DontPanicO.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-11-15T11:54:52.000Z","updated_at":"2024-11-11T17:06:51.000Z","dependencies_parsed_at":"2022-08-13T08:00:43.050Z","dependency_job_id":null,"html_url":"https://github.com/DontPanicO/jwtXploiter","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DontPanicO%2FjwtXploiter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DontPanicO%2FjwtXploiter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DontPanicO%2FjwtXploiter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DontPanicO%2FjwtXploiter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DontPanicO","download_url":"https://codeload.github.com/DontPanicO/jwtXploiter/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224964659,"owners_count":17399436,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctf","ctf-tools","jku","jsonwebtoken","jwks","jwt","jwt-cracker","jwt-exploit","jwt-security","penetration-testing","penetration-testing-tools","pentest","pentest-tool","pentesting","pentesting-tools","security","security-tools","websecurity","x5u-injection"],"created_at":"2024-08-04T01:01:11.345Z","updated_at":"2024-11-18T22:32:04.772Z","avatar_url":"https://github.com/DontPanicO.png","language":"Python","funding_links":[],"categories":["Password-less auth","Python"],"sub_categories":["JWT"],"readme":"[![Python 3.7|3.9](https://img.shields.io/badge/python-3.7|3.9-blue.svg)](https://www.python.org/) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-red.svg)](https://www.gnu.org/licenses/gpl-3.0) [![release 1.2.1](https://img.shields.io/badge/release-1.2.1-yellow.svg)](https://github.com/DontPanicO/jwtXploiter/releases/tag/v1.2.1) [![pypi 1.2.1](https://img.shields.io/badge/pypi-1.2.1-purple.svg)](https://pypi.org/project/jwtxploiter/)\n\n### jwtXploiter\nA tool to test security of JSON Web Tokens.\nTest a JWT against all known CVEs;\n- Tamper with the token payload: changes claims and subclaims values.\n- Exploit known vulnerable header claims (kid, jku, x5u)\n- Verify a token\n- Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only\n- All JWAs supported\n- Generates a JWK and insert it in the token header\n- And much, much more!\n\n### Wiki\n+ Read the wiki!\n[wiki](https://github.com/DontPanicO/jwtXploiter/wiki)\n\n### Installation\nN.B. Cloning the repository should be avoided except for development purposes!\nN.B. Deb package has to be considered beta\n\n+ With rpm:\n  ```console\n  wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm\n  sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm\n  ```\n  or, if previous version is installed on your machine\n  ```console\n  sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm\n  ```\n\n+ With pip:\n  ```console\n  sudo pip install jwtxploiter\n  ```\n\n+ With deb:\n  ```console\n  wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb\n  sudo dpkg -i jwtxploiter_1.2.1-1_all.deb\n  ```\n\n+ Cloing the repo:\n  ```console\n  git clone https://github.com/DontPanicO/jwtXploiter.git\n  ./install.sh\n  ```\n\nN.B. python3-pip package is required to install dependencies, be sure to have it installed.\n\n### Who this tool is written for?\n\n+ Web Application Penetration Tester / Bug Bounty Hunters\n\n  - This tool has been written with the aim of become a key part of pentesters toolkit.\n\n+ Devs who need to test the secuirty of JWTs used in their applications\n\n+ CTF Players\n\n+ Not For Students\n\n  - Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't\n    help you to understand the vulnerabilities it exploits.\n\n### To Know\n\n- For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files\n  in order to avoid conflicts.\n\n- For jku/x5u injection that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required.\n- For redirect attacks the keyword should replace the redirect url, e.g.\n  - http://app.com/foo?redirect=bar\u0026some=thing  --\u003e  http://app.com/foo?redirect=HERE\u0026some=thing\n- For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter,\n  without replacing its value, e.g.\n  - http://app.com/foo?param=value  --\u003e  http://app.com/foo?param=valueHERE\n- Also, in such cases, be sure to pass the server url and your one as comma separated values.\n\n- '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under\n  this path on your server.\n- If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic\n  so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect or\n  HTTP header injection.\n\n- Look at the wiki for a detailed documentation.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FDontPanicO%2FjwtXploiter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FDontPanicO%2FjwtXploiter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FDontPanicO%2FjwtXploiter/lists"}