domains / families / security / jwt-attack

jwt-attack

separate

Decode, forge, brute JWTs when Bearer auth header is seen.

When to use

• API uses `Authorization: Bearer eyJ...` headers.
• JavaScript bundles contain `eyJ...` token patterns.
• After `js-secrets-extraction` finds JWT tokens.
• After `api-noauth-hunt` needs token forging for auth bypass.
• Cookies contain `jwt=`, `token=`, or `session=` with base64-encoded values.

Skill page

Source