# Hunt Jwt Crypto

Hunt JWT cryptographic failures, alg:none signature-stripping and RS256→HS256...

- Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-jwt-crypto -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-jwt-crypto -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-jwt-crypto -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-jwt-crypto -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter`

## Description

Hunt JWT cryptographic failures, alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HUNT-JWT-CRYPTO, Forgeable JSON Web Tokens (A04 Cryptographic Failures)

## What actually pays

A JWT is `header.payload.signature`, each base64url. The signature is the only
thing stopping you from editing the payload (your identity/role) and replaying
it. It pays **High/Critical** when the verifier can be tricked into accepting a
token you forged, so you become another user or an admin without their secret.

Two classic, generic verifier flaws:

- **`alg:none`**, the verifier trusts the token's own `alg` header. Set
  `alg:"none"`, drop the signature, edit the payload (e.g. `role:"admin"`,
  another user's `id`/`email`). A broken verifier skips signature checking.
- **RS256 → HS256 key confusion**, the token is signed RS256 (asymmetric). The
  RSA **public** key is, by definition, public. If the verifier lets you choose
  HS256, it will use that public key as the HMAC *secret*, which you also know.
  Sign an edited payload with HS256 using the public key and it validates.

## Recon, is this app JWT-based?

```
Login/token responses containing  "token":"eyJ..."   or  Set-Cookie: token=eyJ...
Authorization: Bearer eyJ...    on authenticated requests
A JWKS / public-key endpoint:   /.well-known/jwks.json, /jwks, public-key in the JS bundle
```

Decode the header (base64url the first segment). `"alg":"RS256"` → try key
confusion. Any alg → always try `alg:none` first; it's free.

## Forging the token (never hand-encode base64, use a JWT tool)

Use a purpose-built tool so encoding/signing is correct: **jwt_tool**
(`jwt_tool <token> -T` to tamper interactively, `-X a` for alg:none, `-X k -pk
public.pem` for key confusion), Burp's **JWT Editor** extension, or a few lines
of **PyJWT**. Each forge below is the concept plus the claim to edit.

The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/hunt-jwt-crypto/SKILL.md