JWT
InformationalJSON Web Token
Definition
JSON Web Token (JWT) is an open standard (RFC 7519) for creating access tokens that contain claims encoded in JSON. A JWT has three parts: header (algorithm), payload (claims) and signature. They are widely used for API authentication. JWT vulnerabilities can lead to authentication bypass and privilege escalation.
Impact
Stateless authentication widely used in modern APIs'none' algorithm attacks can allow creating unsigned tokensAlgorithm confusion (RS256 to HS256) can allow forging tokensWeak secrets can be brute-forced (jwt_tool, hashcat)Tokens without expiration or with modifiable claims enable account takeover
Examples
JWT structure and common attacks
The most common JWT attacks include: changing the algorithm to 'none' to avoid signature verification, cracking weak secrets with hashcat, or exploiting the confusion between symmetric (HS256) and asymmetric (RS256) algorithms to forge valid tokens.
# JWT structure (3 parts separated by dots):
# HEADER.PAYLOAD.SIGNATURE
# Header (base64url)
{"alg": "HS256", "typ": "JWT"}
# Payload (base64url)
{"userId": "123", "role": "user", "exp": 1713262800}
# Attack 1: Algorithm None
# Change the header to {"alg": "none"} and remove the signature
# eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VySWQiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.
# Attack 2: Crack a weak secret
$ hashcat -a 0 -m 16500 jwt.txt rockyou.txt
# If the secret is "password123", you can now sign arbitrary tokens