jwt_tool : Unlocking JWT Security With The JSON Web Token Toolkit

Discover the power of jwt_tool, a comprehensive toolkit designed for the robust testing of JSON Web Tokens (JWTs).

Perfect for pentesters and developers, this toolkit offers a variety of functions, from validating token authenticity to exploiting known vulnerabilities.

Dive into the capabilities of jwt_tool and enhance your security skills and knowledge.

Its functionality includes:

• Checking the validity of a token
• Testing for known exploits:
  • (CVE-2015-2951) The alg=none signature-bypass vulnerability
  • (CVE-2016-10555) The RS/HS256 public key mismatch vulnerability
  • (CVE-2018-0114) Key injection vulnerability
  • (CVE-2019-20933/CVE-2020-28637) Blank password vulnerability
  • (CVE-2020-28042) Null signature vulnerability
• Scanning for misconfigurations or known weaknesses
• Fuzzing claim values to provoke unexpected behaviours
• Testing the validity of a secret/key file/Public Key/JWKS key
• Identifying weak keys via a High-speed Dictionary Attack
• Forging new token header and payload contents and creating a new signature with the key or via another attack method
• Timestamp tampering
• RSA and ECDSA key generation, and reconstruction (from JWKS files)
• …and lots more!

---

Audience

This tool is written for pentesters, who need to check the strength of the tokens in use, and their susceptibility to known attacks.

A range of tampering, signing and verifying options are available to help delve deeper into the potential weaknesses present in some JWT libraries.

It has also been successful for CTF challengers – as CTFs seem keen on JWTs at present.

It may also be useful for developers who are using JWTs in projects, but would like to test for stability and for known vulnerabilities when using forged tokens.

---

Requirements

This tool is written natively in Python 3 (version 3.6+) using the common libraries, however various cryptographic funtions (and general prettiness/readability) do require the installation of a few common Python libraries.
(An older Python 2.x version of this tool is available on the legacy branch for those who need it, although this is no longer be supported or updated)

---

Installation

Docker

The preferred usage for jwt_tool is with the official Dockerhub-hosted jwt_tool docker image
The base command for running this is as follows:
Base command for running jwt_tool:
docker run -it --network "host" --rm -v "${PWD}:/tmp" -v "${HOME}/.jwt_tool:/root/.jwt_tool" ticarpi/jwt_tool

By using the above command you can tag on any other arguments as normal.
Note that local files in your current working directory will be mapped into the docker container’s /tmp directory, so you can use them using that absolute path in your arguments.
i.e.
/tmp/localfile.txt

Manual Install

Installation is just a case of downloading the jwt_tool.py file (or git clone the repo).
(chmod the file too if you want to add it to your $PATH and call it from anywhere.)

$ git clone https://github.com/ticarpi/jwt_tool
$ python3 -m pip install -r requirements.txt

On first run the tool will generate a config file, some utility files, logfile, and a set of Public and Private keys in various formats.

Custom Configs

• To make best use of the scanning options it is strongly advised to copy the custom-generated JWKS file somewhere that can be accessed remotely via a URL.
  • This address should then be stored in jwtconf.ini as the “jwkloc” value.
• In order to capture external service interactions – such as DNS lookups and HTTP requests – put your unique address for Burp Collaborator (or other alternative tools such as RequestBin) into the config file as the “httplistener” value.
  
  • Review the other options in the config file to customise your experience.

Colour Bug In Windows

To fix broken colours in Windows cmd/Powershell: uncomment the below two lines in jwt_tool.py (remove the “# ” from the beginning of each line)
You will also need to install colorama: python3 -m pip install colorama

# import colorama
# colorama.init()

For more information click here.