jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo cargo install jwt-hack Homebrew brew install jwt-hack Snapcraft Ubuntu sudo snap install jwt-hack Chocolatey Windows choco install jwt-hack From source git clone...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...

MyJWT

MyJWT codebeat badge Introduction This cli is for pentesters, CTF players, or dev. You can modify your jwt, sign, inject ,etc... Check Documentation for more information. If you see problems or enhancement send an issue.I will respond as soon as possible. Enjoy : Documentation Documentation is...

longfellow-zk

Longfellow ZK Overview The Longfellow library enables the construction of zero-knowledge protocols concerning legacy identity verification standards such as the ISO MDOC standard, the JWT standard, and W3 Verifiable Credentials. This implementation is described in: Anonymous credentials from ECDS...

RS256-2-HS256

RS256-2-HS256 JWT Attack to change the algorithm RS256 to HS256 Usage usage: RS2562HS256JWT.py -h payload pubkey positional arguments: payload JSON payload from JWT to attack pubkey Public key file to use for signing optional arguments: -h, --help show this help message and exit Example...

JWTXposer

JWTXposer Automated JWT Discovery & Analysis Tool for Bug Bounty Hunters and Red Teamers What Is JWTXposer? JWTXposer is an automated reconnaissance tool that scans public archives like the Wayback Machine , extracts leaked JWT tokens , and decodes them to identify potentially exploitable...

jwt-key-id-injector

JWT Key ID Injector Simple python script to check against hypothetical JWT vulnerability. Let's say there is an application that uses JWT tokens signed HS256 algorithm. An example token looks like the follow:...

jwtear

Jwtear A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible...

JWTweak

JWTweak Introduction JWTweak is a guided, fully-offline JWT security-testing toolkit. It detects the algorithm of an input token, analyses it for risky configuration, recommends the attacks that fit, and walks you through each one — no flags to memorise. Just run it: python3 JWTweak.py Paste a...

sign-saboteur

SignSaboteur SignSaboteur is a Burp Suite extension for editing, signing, verifying, and attacking signed tokens. It supports different types of tokens: Django TimestampSigner, ItsDangerous Signer, Express cookie-session middleware, OAuth2 Proxy, Tornado’s signed cookies, Ruby Rails Signed cookie...

krakenhashes

KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...

TokenTacticsV2

/ / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku. Azure JSON Web...

CVE-2026-125836

Cross-Site Request Forgery CSRF vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8...

CVE-2025-10294

Exploit: Authentication Bypass via Empty ownidsharedsecret JWT Forgery 1 Forge a valid JWT using an empty HMAC key SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

talos

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and...

TokenBreaker

TokenBreaker Token Breaker is focused on 2 particular vulnerability related to JWT tokens. None Algorithm RSAtoHMAC Refer to this link about insights of the vulnerability and how an attacker can forge the tokens Try out this vulnerability here TheNone Usage usage: TheNone.py -h -t TOKEN...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CVE-2022-21449-vuln-test

CVE-2022-21449 Vulnerability tester Introduction There's a new CVE-2022-21449 that had bug in ECDSA signature verification. It's one of the algorithms used with JWT for example. Citing the blog post If you have deployed Java 15, Java 16, Java 17, or Java 18 in production then you should stop what...

CVE-2026-125836

The Nicu Micle Simple JWT Login plugin for WordPress (versions n/a through 3.6.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . This vulnerability allows an attacker to perform unauthorized actions on behalf of a user. The CVSS 3.1 score for this issue is 8.8 (High) , indicating signifi...