{"categories":[{"label":"WWW/HTTP","url":"https://skillfed.io/packages/category/internet-www-http/8"},{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"A command-line tool for testing and manipulating JSON Web Tokens (JWTs), including modification, signing, verification, and exploitation of common JWT vulnerabilities.","skillfed_tags":["jwt-testing","penetration-testing","cryptography"],"use_cases":["Test for the none algorithm vulnerability in JWT implementations by attempting to bypass signature verification.","Brute-force JWT secrets using a wordlist to discover weak signing keys used in production systems.","Modify JWT payloads and headers to test authorization bypass or privilege escalation in web applications.","Exploit RSA/HMAC algorithm confusion to forge valid signatures using a public key as the HMAC secret.","Test jku and x5u header injection vulnerabilities to bypass JWT validation through external key sources.","Crack JWT signatures using regex patterns to guess keys based on known character sets or patterns."],"what_it_does":"MyJWT is a command-line pentesting tool designed for security researchers, CTF players, and developers to inspect, modify, and test JWT tokens. It provides a user interface for decoding JWTs, altering headers and payloads, signing with custom keys, and attempting to crack or verify signatures through brute-force or regex-based attacks. The tool also includes features to test known JWT vulnerabilities such as the none algorithm, RSA/HMAC confusion, kid injection, and jku/x5u header bypasses.\n\nThe tool operates as a standalone CLI with no external runtime dependencies, making it lightweight to install and run. It can modify JWT components, send crafted tokens to target URLs with custom HTTP methods and data, and copy results to the clipboard for easy integration into testing workflows. It's particularly useful for security assessments where JWT validation logic needs to be tested or where token manipulation is part of the attack surface.","worth_installing":"Yes. The tool is actively maintained, has no external dependencies, supports current Python versions, carries a permissive license, and has no known vulnerabilities. It is well-suited for security professionals and developers who need to test JWT implementations. Install it if you regularly perform JWT security assessments or CTF challenges."},"id":"myjwt","links":{"html":"https://skillfed.io/packages/myjwt","md":"https://skillfed.io/packages/myjwt.md","pypi":"https://pypi.org/project/myjwt/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2024-07-10","license_spdx":null,"license_treatment":"permissive","name":"myjwt","python_support":"supports_current","summary":"Pentesting Tool for JWT(JSON Web Tokens).Modify/Crack/Check Your jwt."},"popularity":{"monthly_downloads":84851,"position":13966,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"2.1.0"}