Exploit for jwt_tool

## https://sploitus.com/exploit?id=KITPLOIT:5268517342174105299
# The JSON Web Token Toolkit v2

> _jwt_tool.py_ is a toolkit for validating, forging, scanning and tampering JWTs (JSON Web Tokens).

![jwt_tool version](https://img.shields.io/badge/version-v2.3.0-blue) ![python version](https://img.shields.io/badge/python-v3.6+-green)

![logo](https://assets.kitploit.com/production/public/readmes/2567/2498451920676d469a5ecdd5529728241e4a835c10087f58c3639c63a4234fce.png)

Its functionality includes:

  * Checking the validity of a token
  * Testing for known exploits: 
    * (CVE-2015-2951) The _**alg=none**_ signature-bypass vulnerability
    * (CVE-2016-10555) The _**RS/HS256**_ public key mismatch vulnerability
    * (CVE-2018-0114) _**Key injection**_ vulnerability
    * (CVE-2019-20933/CVE-2020-28637) _**Blank password**_ vulnerability
    * (CVE-2020-28042) _**Null signature**_ vulnerability
    * (CVE-2022-21449) _**Psychic Signature**_ ECDSA vulnerability
  * Scanning for misconfigurations or known weaknesses
  * Fuzzing claim values to provoke unexpected behaviours
  * Testing the validity of a secret/key file/Public Key/JWKS key
  * Identifying _**weak keys**_ via a High-speed _**Dictionary Attack**_
  * Forging new token header and payload contents and creating a new signature with the **key** or via another attack method
  * Timestamp tampering
  * RSA and ECDSA key generation, and reconstruction (from JWKS files)
  * Rate-limiting for all attacks
  * ...and lots more!



* * *

## Audience