6063 matches found
CVE-2025-8625
CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution 🛡️ Copypress Rest API 1.1 - 1.2 RCE Exploit 📝 Description The Copypress Rest API plugin for WordPress versions 1.1 to 1.2 is vulnerable to Remote Code...
CVE-2021-37580
CVE-2021-37580 POC for CVE-2021-37580 0x00 Vulnerability Principle Vulnerability principle: Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 Single URL Usage: python3 CVE-2021-37580.py -u url -n username.txt For shenyu-admin-2.4.0, vulnerable versions see below: For...
JWTweak
JWTweak Introduction JWTweak is a guided, fully-offline JWT security-testing toolkit. It detects the algorithm of an input token, analyses it for risky configuration, recommends the attacks that fit, and walks you through each one — no flags to memorise. Just run it: python3 JWTweak.py Paste a...
talos
Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and...
CVE-2019-19609-EXPLOIT
CVE-2019-19609-EXPLOIT Exploit for CVE-2019-19609 in Strapi Remote code execution in strapi-3.0.0-beta.17.7 or earlier. I was faced with a scenario with this vulnerability, but without a public exploit. I decided to create my own and share it here. Instalation git clone...
auth
Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...
CVE-2022-21449-vuln-test
CVE-2022-21449 Vulnerability tester Introduction There's a new CVE-2022-21449 that had bug in ECDSA signature verification. It's one of the algorithms used with JWT for example. Citing the blog post If you have deployed Java 15, Java 16, Java 17, or Java 18 in production then you should stop what...
TokenBreaker
TokenBreaker Token Breaker is focused on 2 particular vulnerability related to JWT tokens. None Algorithm RSAtoHMAC Refer to this link about insights of the vulnerability and how an attacker can forge the tokens Try out this vulnerability here TheNone Usage usage: TheNone.py -h -t TOKEN...
JWT_Brute
JWTBrute Example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9.56wwCrB9tIgmUnYpLPxkO8GYj1soCjuuskTlbHGg8 eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 base64 decode "alg":"HS256","typ":"JWT" eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9 base64 decode...
CVE-2025-68860
WordPress Mobile Builder = 1.4.2 - Broken Authentication CVE-2025-68860 Description The WordPress Mobile Builder plugin version 1.4.2 and below has a Broken Authentication vulnerability that allows an attacker to generate a valid JWT token with the default secret "examplekey" and authenticate as...
JWTXposer
JWTXposer Automated JWT Discovery & Analysis Tool for Bug Bounty Hunters and Red Teamers What Is JWTXposer? JWTXposer is an automated reconnaissance tool that scans public archives like the Wayback Machine , extracts leaked JWT tokens , and decodes them to identify potentially exploitable...
decoder-plus-plus
Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...
CVE-2025-65945-poc
CVE-2025-65945: node-jws Signature Bypass This is a proof of concept for a signature verification bypass in the node-jws library. The bug lets attackers forge valid JWTs when the server derives HMAC secrets from user-controlled data. What's the bug? The jws.createVerify function doesn't validate...
private-landing
Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...
jwtear
Jwtear A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible...
oauth2-proxy
OAuth2 Proxy is a flexible, open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. It provides a simple and secure way to protect your web applications with OAuth2 / OIDC authentication. As a...
jwt-key-id-injector
JWT Key ID Injector Simple python script to check against hypothetical JWT vulnerability. Let's say there is an application that uses JWT tokens signed HS256 algorithm. An example token looks like the follow:...
longfellow-zk
Longfellow ZK Overview The Longfellow library enables the construction of zero-knowledge protocols concerning legacy identity verification standards such as the ISO MDOC standard, the JWT standard, and W3 Verifiable Credentials. This implementation is described in: Anonymous credentials from ECDS...
krakenhashes
KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...