Jwt Oauth Token Attacks

This is a comprehensive attack playbook for JWT and OAuth token security testing. It walks through the classic cryptographic bypasses like algorithm confusion (RS256 to HS256), the alg:none trick, and HMAC secret cracking with hashcat. You also get OAuth flow attacks like state CSRF, redirect_uri bypasses, and implicit flow token leakage via Referer headers. The kid injection section covers SQL injection and path traversal variants, plus jku header abuse for JWKS poisoning. Use this when you're auditing authentication flows and need specific payloads and tooling commands ready to go. It's thorough enough that you won't miss the obvious attacks but stays practical with curl snippets and jwt_tool examples.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill jwt-oauth-token-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: JWT and OAuth 2.0 Token Attacks — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert authentication token attacks. Covers JWT cryptographic attacks (alg:none, RS256→HS256, secret crack, kid/jku injection), OAuth flow attacks (CSRF, open redirect, token theft, implicit flow abuse), PKCE bypass, and token leakage via Referer/logs. This is critical for modern web applications.

0. RELATED ROUTING

Use this file for token-centric attacks and flow abuse. Also load:

oauth oidc misconfiguration for redirect URI, state, nonce, PKCE, and account-binding validation
cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin
saml sso assertion attacks when the target uses enterprise SSO outside OAuth/OIDC