JWT Security Testing
This skill should be used when the user asks to "test JWT security", "hack JWT tokens", "bypass JWT authentication", "crack JWT secrets", or "exploit JWT vulnerabilities". It provides comprehensive JSON Web Token attack techniques and security assessment methodologies.
Installation
SKILL.md
Identify and exploit vulnerabilities in JSON Web Token (JWT) implementations, including algorithm confusion attacks, secret key cracking, signature bypass, and claim manipulation. JWTs are widely used for authentication and authorization, making them high-value targets for security testing.
| HS256 | Symmetric | HMAC with SHA-256 | | HS384 | Symmetric | HMAC with SHA-384 | | HS512 | Symmetric | HMAC with SHA-512 | | RS256 | Asymmetric | RSA with SHA-256 | | RS384 | Asymmetric | RSA with SHA-384 | | RS512 | Asymmetric | RSA with SHA-512 | | ES256 | Asymmetric | ECDSA with SHA-256 | | none | None | No signature |
| None Algorithm | Accepts unsigned tokens | "alg": "none" | | Secret Cracking | Weak HMAC secret | Brute-force | | Key Confusion | RSA key as HMAC secret | Sign with public key | | JWK Injection | Trusts embedded keys | Embed attacker JWK | | KID Injection | Unvalidated kid | Path traversal/SQLi |
Facts (cite-ready)
Stable fields and commands for AI/search citations.
- Install command
npx skills add https://github.com/zebbern/secops-cli-guides --skill JWT Security Testing- Category
- !Security
- Verified
- —
- First Seen
- 2026-02-05
- Updated
- 2026-02-18
Quick answers
What is JWT Security Testing?
This skill should be used when the user asks to "test JWT security", "hack JWT tokens", "bypass JWT authentication", "crack JWT secrets", or "exploit JWT vulnerabilities". It provides comprehensive JSON Web Token attack techniques and security assessment methodologies. Source: zebbern/secops-cli-guides.
How do I install JWT Security Testing?
Open your terminal or command line tool (Terminal, iTerm, Windows Terminal, etc.) Copy and run this command: npx skills add https://github.com/zebbern/secops-cli-guides --skill JWT Security Testing Once installed, the skill will be automatically configured in your AI coding environment and ready to use in Claude Code or Cursor
Where is the source repository?
https://github.com/zebbern/secops-cli-guides
Details
- Category
- !Security
- Source
- user
- First Seen
- 2026-02-05