AI-Assisted JWT Pentesting Using Claude Code + jwt_tool

docker pull ticarpi/jwt_tool

alias jwt_tool='docker run --rm -v "${PWD}:/tmp" -v "${HOME}/.jwt_tool:/root/.jwt_tool" ticarpi/jwt_tool'

pip install PyJWT==2.11.0

npx skills add https://github.com/zebbern/secops-cli-guides --skill 'JWT Security Testing'

# JWT Attack Project

You are a Senior Security Engineer, your are helping me to audit JWT token for security issue

Use JWT security testing SKILLS

## jwt_tool Command
docker run --rm -v ~/.jwt_tool:/root/.jwt_tool ticarpi/jwt_tool <token> [options]

## Common Attack Commands
- Decode token
- None algorithm
- Null signature
- Blank password
- Tamper claims

## Rules
- Always use burp mcp send_http1_request to send HTTP requests with the generated JWT token for attack validation.
- Use curl as fallback, but add -x 127.0.0.1:8080 proxy parameter
- Always use jwt_tool for token generation or analysis, and use native python as a fallback

Use Burp MCP to inspect the /api/profile endpoint and capture both the request and response

Use jwt security testing skill to analyze that JWT token
Decode the header, payload, and identify the signing algorithm

Generate a None algorithm attack token and test it against /api/profile, and use JWT Security Testing Skills

Use jwt security testing skill to perform a null signature attack
Generate token with empty signature using jwt_tool -X n, then test via Burp MCP

Use jwt security testing skill to test if the secret is an empty string
Generate token signed with blank password using jwt_tool -X b, then test via Burp MCP

Use jwt security testing skill to attempt cracking the JWT secret
Run dictionary attack using jwt_tool, dictionary /opt/jwt_tool/jwt-common.txt

Use jwt security testing skill to forge an admin token with the cracked secret (secret123)
Modify claims: isAdmin="true"
Sign the forged token with the cracked secret

Test the forged admin token against /api/admin endpoint

HTTP/1.1 200 OK
{
  "message": "Welcome, admin!",
  "adminData": {
    "users": [...],
    "systemConfig": {...}
  }
}

Create Burp Repeater tabs for ALL attack payloads (including failed ones) for manual verification

Summarize all JWT vulnerabilities found in this session
Include: vulnerabilities found, proof-of-concept steps, and remediation recommendations

# JWT Security Assessment Report
**Target:** vulnerable-api.com:3000
**Date:** 2026-03-06

## Vulnerabilities Found

### 1. Weak JWT Secret (Critical)

**Description:** The JWT secret is a weak, common password (`secret123`).

**Impact:** Attackers can forge tokens with arbitrary claims, including admin privileges.

**Evidence:**
- Secret cracked using dictionary attack
- Forged admin token successfully authenticated

**Proof of Concept:**
```bash
jwt_tool <token> -C -d /path/to/wordlist.txt
# Output: [+] Secret found: secret123

# Direct SecLists MCP integration
jwt_tool <token> -C --wordlist seclists:jwt/common_secrets.txt