A tool to test security of json web token
Alternatives To Jwtxploiter
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
7 days ago50otherRuby
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
Certificates5,159872 days ago245September 12, 2022153apache-2.0Go
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
2 months ago14February 25, 202136mitJavaScript
Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories: www.shhgit.com
Cli2,931783 days ago265September 13, 2022120apache-2.0Go
🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.
Itsdangerous2,63552,12858325 days ago27March 24, 2022bsd-3-clausePython
Safely pass trusted data to untrusted environments and back.
Jwt Spring Security Demo2,534
3 years ago2mitJava
A demo for using JWT (Json Web Token) with Spring Security and Spring Boot 2
U2f Zero2,284
a year ago27otherC
U2F USB token optimized for physical security, affordability, and style
Fosite2,03650649 days ago278April 17, 202228apache-2.0Go
Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
Security Csrf1,5822,902198a month ago430May 14, 2022mitPHP
The Security CSRF (cross-site request forgery) component provides a class CsrfTokenManager for generating and validating CSRF tokens.
Spring Boot Shiro1,496
2 years ago3Java
Shiro基于SpringBoot +JWT搭建简单的restful服务
Alternatives To Jwtxploiter
Select To Compare

Alternative Project Comparisons

Python 3.7|3.9 License: GPL v3 release 1.2.1 pypi 1.2.1


A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs;

  • Tamper with the token payload: changes claims and subclaims values.
  • Exploit known vulnerable header claims (kid, jku, x5u)
  • Verify a token
  • Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only
  • All JWAs supported
  • Generates a JWK and insert it in the token header
  • And much, much more!


  • Read the wiki! wiki


N.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta

  • With rpm:

    wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm
    sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm

    or, if previous version is installed on your machine

    sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm
  • With pip:

    sudo pip install jwtxploiter
  • With deb:

    wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb
    sudo dpkg -i jwtxploiter_1.2.1-1_all.deb
  • Cloing the repo:

    git clone https://github.com/DontPanicO/jwtXploiter.git

N.B. python3-pip package is required to install dependencies, be sure to have it installed.

Who this tool is written for?

  • Web Application Penetration Tester / Bug Bounty Hunters

    • This tool has been written with the aim of become a key part of pentesters toolkit.
  • Devs who need to test the secuirty of JWTs used in their applications

  • CTF Players

  • Not For Students

    • Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities it exploits.

To Know

  • For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts.

  • For jku/x5u injection that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required.

  • For redirect attacks the keyword should replace the redirect url, e.g.

  • For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g.

  • Also, in such cases, be sure to pass the server url and your one as comma separated values.

  • '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server.

  • If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect or HTTP header injection.

  • Look at the wiki for a detailed documentation.

Popular Token Projects
Popular Security Projects
Popular Security Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Penetration Testing
Capture The Flag
Security Tools
Pentest Tool
Web Application Security