What is JSON Web Token? JWT (JSON Web Token) is an open standard ( RFC 7519 ) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA . In this post, we will see how to test, tw e ak, and try to crack JWTs. There are few open-source libraries that we can use. One such utility is https://github.com/ticarpi/jwt_tool which is a toolkit for testing, tweaking, and cracking JSON Web Tokens. This tool is written in Python 3 (version 3.6+). Its functionality includes: Checking the validity of a token Testing for known exploits: (CVE-2015–2951) The alg=none signature-bypass vulnerability (CVE-2016–10555) The RS/HS256 public key mismatch vulnerability (CVE-2018–0114) Key inject...
Notes from a software engineer on technology, AI, developer productivity, side projects, and quantified self. Documenting ideas, experiments, and insights along the way.