ClaimJumper

   _____ _       _            _                                
  / ____| |     (_)          | |                               
 | |    | | __ _ _ _ __ ___  | |_   _ _ __ ___  _ __   ___ _ __ 
 | |    | |/ _` | | '_ ` _ \ | | | | | '_ ` _ \| '_ \ / _ \ '__|
 | |____| | (_| | | | | | | || | |_| | | | | | | |_) |  __/ |   
  \_____|_|\__,_|_|_| |_| |_|/ |\__,_|_| |_| |_| .__/ \___|_|   
                           |__/               | |               
                                              |_|  v0.1.0

Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-specific attacks.

Features

Core Analysis

• JWT decoding and vulnerability scanning
• 15+ security checks (alg=none, weak algorithms, missing claims, sensitive data)
• Risk scoring with detailed remediation

Advanced Attacks

• Algorithm Confusion (CVE-2022-39227)
• Kid Header Injection (path traversal, SQLi)
• JKU/X5U Injection
• Null Signature Bypass (CVE-2020-28042)
• Psychic Signature (CVE-2022-21449)
• JWKS Spoofing

Secret Cracking

• Multi-threaded (~19k secrets/sec)
• 100k+ Wallarm wordlist included
• Custom wordlist support

Installation

pip install -e .

Quick Start

# Analyze a token
claimjumper analyze eyJhbGciOiJIUzI1NiIs...

# Generate attack tokens
claimjumper advanced-attacks <token>

# Crack secret (8 threads)
claimjumper crack <token> -t 8

# Full security audit
claimjumper full-audit <token>

Commands

Web Interface

Open jwt_analyzer.html for a minimal web UI with:

• Token analysis
• Attack generation
• Token forging

Security Checks

Exit Codes

• 0 — Analysis complete / No secret found
• 1 — Vulnerabilities found / Secret cracked
• 2 — Error

License

MIT

ClaimJumper — For authorized security testing only.