hahwul / jwt-hack Goto Github PK

🔩 jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)

License: MIT License

Go 98.49% Dockerfile 1.51%

jwt hacking bugbounty security tool testing-tools cracking payload-generator hacktoberfest

jwt-hack's Issues

hello, JWT encode error in windows

JSON Unmarshal Error

Whether to support jjwt format(zip)

Unloaded wordlist file on snapcraft version

similar issue
hahwul/dalfox#134

brute and verbose can't works

i try to use brute mode to decrypt an example, in 5 minutes ,it doesn't have any log on terminal.

./jwt-hack crack eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.cAOIAifu3fykvhkHpbuhbvtH807-Z2rI1FS3vX1XMjE -m brute --power --verbose
   d8p 8d8   d88 888888888          888  888 ,8b.     doooooo 888  ,dP
   88p 888,o.d88    '88d     ______ 88888888 88'8o    d88     888o8P'
   88P 888P`Y8b8   '888      XXXXXX 88P  888 88PPY8.  d88     888 Y8L
88888' 88P   YP8 '88p               88P  888 8b   `Y' d888888 888  `8p
-------------------------
[*] Start brute cracking mode



^C

Warning: Calling bottle :unneeded is deprecated! There is no replacement.

Please report this issue to the hahwul/gee tap (not Homebrew/brew or Homebrew/core):
/usr/local/Homebrew/Library/Taps/hahwul/homebrew-gee/Formula/gee.rb:9

Ascii logo

     d8p 8d8   d88 888888888          888  888 ,8b.     doooooo 888  ,dP 
     88p 888,o.d88    '88d     ______ 88888888 88'8o    d88     888o8P'  
     88P 888P`Y8b8   '888      XXXXXX 88P  888 88PPY8.  d88     888 Y8L  
  88888' 88P   YP8 '88p               88P  888 8b   `Y' d888888 888  `8p

Spec of feature / options

기능

모드

$ jwt-hack

jwt timeconvert and expire time in decode

segmentation violation

If there is an abnormal input among some functions, error handling is not performed. (by nil)

e.g

 jwt-hack decode abcd                                                                                                                                          10:05:38 오후
   d8p 8d8   d88 888888888          888  888 ,8b.     doooooo 888  ,dP 
   88p 888,o.d88    '88d     ______ 88888888 88'8o    d88     888o8P'  
   88P 888P`Y8b8   '888      XXXXXX 88P  888 88PPY8.  d88     888 Y8L 
88888' 88P   YP8 '88p               88P  888 8b   `Y' d888888 888  `8p
-------------------------
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x5f709b]

goroutine 1 [running]:
github.com/hahwul/jwt-hack/cmd.glob..func2(0x7eb600, 0xc000098920, 0x1, 0x1)
        /home/devi/go/src/github.com/hahwul/jwt-hack/cmd/decode.go:30 +0x17b

jwt-hack encode abcd                                                                                                                                          10:05:42 오후
   d8p 8d8   d88 888888888          888  888 ,8b.     doooooo 888  ,dP 
   88p 888,o.d88    '88d     ______ 88888888 88'8o    d88     888o8P'  
   88P 888P`Y8b8   '888      XXXXXX 88P  888 88PPY8.  d88     888 Y8L 
88888' 88P   YP8 '88p               88P  888 8b   `Y' d888888 888  `8p
-------------------------
ERRO[0000] JSON Unmarshal Error                         
panic: 0

goroutine 1 [running]:
github.com/hahwul/jwt-hack/cmd.glob..func3(0x7eb8a0, 0xc000056950, 0x1, 0x1)
        /home/devi/go/src/github.com/hahwul/jwt-hack/cmd/encode.go:25 +0x45b
github.com/spf13/cobra.(*Command).execute(0x7eb8a0, 0xc000056920, 0x1, 0x1, 0x7eb8a0, 0xc000056920)
        /home/devi/go/src/github.com/spf13/cobra/command.go:854 +0x2c2
github.com/spf13/cobra.(*Command).ExecuteC(0x7ebde0, 0x4456ea, 0x7d0e80, 0xc000000180)

Does not stop when finding secret during crack

Token encodings not removing base64 padding

In payloads.go, when you encode the JWT after tampering with it, you encode with b64.StdEncoding.EncodeToString(). However, you should use base64.RawURLEncoding.EncodeToString(). The second method strips the padding from the base64 (i.e. the equals sign), which should not be present in the token as per the JWT guidelines (section 7).

For example, when I used the "payloads" method on this token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRheWxvciJ9.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po

The payload genertated for the alg:none exploit was:
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0=.eyJsb2dpbiI6InRheWxvciJ9.

The payload for "x5u host header injection (w/CRLF) payload" was:
eyJhbGciOiJoczI1NiIsIng1dSI6Imh0dHBzOi8vJTBkMGFIb3N0OiAiLCJ0eXAiOiJKV1QifQ==.eyJsb2dpbiI6InRheWxvciJ9.

Note the "=" sign padding in both examples.

Thank you for the tool!

jwt-hack always kills the process while using rockyou.txt

For some reason the tool kills the process after some time processing rockyou.txt, since it's 14m+ password there, but when I tried a 10m+ list it worked fine without any problem, Is that something related to golang or something you can fix from your end?

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

”fatal error: out of memory“ when running in brute mode

When running in brute mode for a period of time, this error will appear.

hahwul / jwt-hack Goto Github PK

jwt-hack's Issues

Recommend Projects

Recommend Topics

Recommend Org

Jobs