jwt-hack: tool for hacking/security testing to JWT

jwt-hack

jwt-hack is a tool for hacking/security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brute force).

Use

   d8p 8d8   d88 888888888          888  888 ,8b.     doooooo 888  ,dP

   88p 888,o.d88    '88d     ______ 88888888 88'8o    d88     888o8P'

   88P 888P`Y8b8   '888      XXXXXX 88P  888 88PPY8.  d88     888 Y8L

88888' 88P   YP8 '88p               88P  888 8b   `Y' d888888 888  `8p

-------------------------

Hack the JWT(JSON Web Token) | by @hahwul | v1.0.0



Usage:

  jwt-hack [command]



Available Commands:

  crack       Cracking JWT Token

  decode      Decode JWT to JSON

  encode      Encode json to JWT

  help        Help about any command

  payload     Generate JWT Attack payloads

  version     Show version



Flags:

  -h, --help   help for jwt-hack

Encode mode(JSON to JWT)

▶ jwt-hack encode ‘{“json”:”format”}’ –secret={YOUR_SECRET}

Decode mode(JWT to JSON)

▶ jwt-hack decode {JWT_CODE}

Crack mode(Dictionary attack / BruteForce)

▶ jwt-hack crack -w {WORDLIST} {JWT_CODE}

Payload mode(Alg none attack, etc..)

▶ jwt-hack payload {JWT_CODE}

for jku and x5u (what is? readme this slide)

• –jwk-attack : A attack payload domain for jku&x5u (e.g hahwul.com)
• –jwk-trust : jku&x5u protocol (http/https) (default “https”)
• –jwk-protocol : A trusted domain for jku&x5u (e.g google.com)

Download

Copyright (c) 2020 HAHWUL