HACKR.GG
Authentication & Access Control

JWT Attacks

JSON Web Tokens are everywhere — and frequently misconfigured. Learn the full attack surface: weak secrets, the none algorithm, algorithm confusion, and key injection.

Intermediate40 min8 lessons2 hands-on
Start free →I have an account
First lesson free. The full module is part of Pro.

You'll be able to

  • ✓Decode and understand the structure of a JSON Web Token
  • ✓Exploit the "none" algorithm bypass to forge unsigned tokens
  • ✓Perform algorithm confusion attacks (RS256 → HS256)
  • ✓Extract secrets from weak HS256 keys with offline cracking

Lessons

  1. 1Real Breach: Auth0 Algorithm Confusion — Billions of Users at Risk
  2. 2JWT Structure Deep Dive
  3. 3The Four JWT Attacks
  4. 4Your Turn: Strip the SignatureHANDS-ON
  5. 5Mini Lab — Decode and Attack a JWT
  6. 6Tool: jwt_tool — JWT Attack Toolkit
  7. 7Module quiz
  8. 8Hands-on Lab: Exploit Chirper APIHANDS-ON
Start free →