# API Auth And Jwt Abuse

API authentication and JWT abuse playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse -g -a gemini-cli -y`

## Description

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: API Auth and JWT Abuse, Token Trust, Header Tricks, and Rate Limits

> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

## 1. TOKEN TRIAGE

Inspect:

- `alg`, `kid`, `jku`, `x5u`
- role, org, tenant, scope, or privilege claims
- issuer and audience mismatches
- reuse of mobile and web tokens across products

## 2. QUICK ATTACK PICKS

| Pattern | First Test |
|---|---|
| `alg:none` acceptance | unsigned token with trailing dot |
| RS256 confusion | switch to HS256 using public key as secret |
| `kid` lookup trust | path traversal or injection in `kid` |
| remote key fetch trust | attacker-controlled `jku` or `x5u` |
| weak secret | offline crack with targeted wordlists |

## 3. HIDDEN FIELDS AND BATCH ABUSE

### Mass assignment field picks

```text
role
isAdmin
admin
verified
plan
tier
permissions
org
owner
```

### Rate limit and batch abuse picks

```text
X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9
```

GraphQL or JSON batch abuse candidates:

- arrays of login mutations
- bulk object fetches with varying IDs
- repeated password reset or verification calls in one request

## 4. RATE LIMIT BYPASS FAMILIES

```text
X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants
```

## 5. NEXT ROUTING

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/api-auth-and-jwt-abuse/SKILL.md