← Home
JWT

JWT Security

Complete guide to attacking JSON Web Tokens — from basic anatomy to post-quantum cryptography. 20 articles with real CVEs, PoCs and pentest techniques.

18 articles
  1. 01 Why JWT is the most broken standard on the web
  2. 02 JWT Anatomy - dissecting the token byte by byte
  3. 03 alg:none - one line and you're admin
  4. 04 Algorithm Confusion - public key as password
  5. 05 kid injection - SQL Injection via token header
  6. 06 jku/x5u/jwk/x5c - the entire JWT header is an attack surface
  7. 07 Brute-forcing JWT secrets on GPU
  8. 08 Psychic Signatures - zero signature on Java
  9. 09 JWT Cryptography for Hackers
  10. 10 JWE - encrypted tokens and how to break them
  11. 11 JWT Libraries - a Leakiness Ranking
  12. 12 JWT in OAuth 2.0 and OIDC - where it breaks in the real world
  13. 13 XSS + JWT = Full Account Takeover
  14. 14 Advanced Crypto Attacks - Lattices, Side-Channels, and Fault Injection
  15. 17 Hardcoded Secrets - When the Key Is Sitting in the Source Code
  16. 18 What Instead of JWT - PASETO, Macaroons, Opaque Tokens, and Server-Side Sessions
  17. 19 RFC 8725 - the checklist nobody reads
  18. 20 Post-Quantum JWT and the Future of Tokens