Api Auth And Jwt Abuse

Focused playbook for breaking API auth through JWT manipulation and header spoofing. Walk through token triage looking at algorithm confusion (alg:none, RS256 to HS256), kid injection, and remote key fetch trust issues, then pivot to mass assignment field hunting and rate limit bypasses using X-Forwarded-For tricks. The quick attack table is handy for initial probes, and the batch abuse section covers GraphQL mutation flooding and bulk enumeration patterns. Routes you cleanly to deeper OAuth and OIDC skills when you hit SSO flows or need full token attack depth. Good first touch when you spot Bearer tokens or API keys and want systematic coverage without overthinking it.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits

AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

1. TOKEN TRIAGE

Inspect:

alg, kid, jku, x5u
role, org, tenant, scope, or privilege claims
issuer and audience mismatches
reuse of mobile and web tokens across products

2. QUICK ATTACK PICKS

Pattern	First Test
`alg:none` acceptance	unsigned token with trailing dot
RS256 confusion	switch to HS256 using public key as secret
`kid` lookup trust	path traversal or injection in `kid`
remote key fetch trust	attacker-controlled `jku` or `x5u`
weak secret	offline crack with targeted wordlists

3. HIDDEN FIELDS AND BATCH ABUSE

Mass assignment field picks

role
isAdmin
admin
verified
plan
tier
permissions
org
owner

Rate limit and batch abuse picks

X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9

GraphQL or JSON batch abuse candidates:

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Categories: Backend & APIs, Testing & QA, Security
First seen: May 16, 2026