JWTweak

JWTweak Introduction JWTweak is a guided, fully-offline JWT security-testing toolkit. It detects the algorithm of an input token, analyses it for risky configuration, recommends the attacks that fit, and walks you through each one — no flags to memorise. Just run it: python3 JWTweak.py Paste a...

autocrack

AUTOCRACK.py This python script is a Hashcat https://hashcat.net wrapper to help automate the cracking process. The script includes multiple functions to select a set of wordlists and rules, as well as the ability to run a bruteforce attack, with custom masks, before the wordlist/rule attacks...

CVE-2021-44910_SpringBlade

CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...

TokenBreaker

TokenBreaker Token Breaker is focused on 2 particular vulnerability related to JWT tokens. None Algorithm RSAtoHMAC Refer to this link about insights of the vulnerability and how an attacker can forge the tokens Try out this vulnerability here TheNone Usage usage: TheNone.py -h -t TOKEN...

TP-Link-TL-WR820N-CVE-2025-14175

🔐 CVE-2025-14175 Weak Algorithm Support in SSH Server – TP-Link TL-WR820N Overview This repository documents a security vulnerability identified in the SSH server implementation of the TP-Link TL-WR820N v2.80 router. The vulnerability allowed the use of weak cryptographic algorithms , potentially...

frelatage

pip3 install frelatage The Python Fuzzer that the world deserves Installation | How it works | Features | Use Frelatage | Configuration Frelatage is a coverage-based Python fuzzing library which can be used to fuzz python code. The development of Frelatage was inspired by various other fuzzers,...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – JWT Algorithm Confusion via kid Injection Program Code Node.js server + Python exploit // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const axios = require'axios'; cons...

princeprocessor

princeprocessor Standalone password candidate generator using the PRINCE algorithm The name PRINCE is used as an acronym and stands for PRobability INfinite Chained Elements, which are the building blocks of the algorithm Brief description The princeprocessor is a password candidate generator and...

CVE-2025-63353

CVE-2025-63353: Predictable Wi-Fi Password Vulnerability in FiberHome GPON ONT Devices References Based on research by Hanianis original CVE disclosure at CVE-2025-63353 Thanks to the security researchers who identified this vulnerability. Legal Disclaimer This information is provided for...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

cve-2026-102268-poc

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass Exploitability analysis result: the root cause is confirmed and end-to-end exploitation is reproducible. A whitespace-mutated PEM public key bypasses PyJWT's ispemformat guard and is accepted as a valid HMAC secret, enabling full HS256 token...

CVE-2023-48223

CVE-2023-48223 PoC fast-jwt Algorithm Confusion This repository demonstrates JWT algorithm confusion in fast-jwt when token verification does not lock allowed algorithms. Environment Setup Requirements Node.js 18 or newer npm OpenSSL must be available in your terminal PATH 1 Install dependencies...

CVE-2021-42574

CVE-2021-42574 - Code generator // Update: 05.11.2021 It's now possible to not only encode, but also decode files. Means that now files containing supported bidi chars can be translated to template files with bidi placeholders LRO, .... Generate malicious files using recently published bidi-attac...

poc-cve-2016-10555

Change the algorithm RS256asymmetric to HS256symmetric - POC CVE-2016-10555 The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. If you change the algorithm from RS256 to...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt Authentication Bypass POC This repository contains a proof-of-concept POC for an authentication bypass vulnerability in pac4j-jwt CVE-2026-29000. The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT using alg: none inside a JWE JSON...

CVE-2020-0601-EXP

CVE-2020-0601-EXP This resource is the author's reproduction of the Microsoft signature certificate vulnerability CVE-2020-0601, implemented by combining related resources and articles. It is recommended that you read the author's blog to understand the ECC algorithm, Windows verification...

EITest-tools-scripts-IOCs

IOCs Indicators of Compromise IOCs updated every 30 minutes related to EITest campaigns. The domain stat-dns.com used in EITest's DGA algorithmhas been sinkholed. As a result, the EITest campaign now appears to have been shutdown since 2018-03-15. backend-decipher.py Decodes data transmitted from...

Quantum-Algorithm-for-Elliptic-Curve-Discrete-Logarithms-with-Space-Efficient-Point-Addition

Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition This repository contains Qiskit code for resource estimation of the space-efficient quantum modular inversion and affine point-addition circuits used in elliptic-curve discrete logarithm settings. The...