aress31 / jwtcat

A CPU-based JSON Web Token (JWT) cracker and - to some extent - scanner.

jwtcat

A CPU-based JSON Web Token (JWT) cracker and - to some extent - scanner

jwtcat is a Python script designed to detect and exploit well-known cryptographic flaws present in JSON Web Token (JWT).

These vulnerabilities, if successfully exploited by an adversary could allow authentication bypass, information disclosure and could ultimately lead to the compromise of an entire information system.

More information about JWT vulnerabilities can be found at:

• https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Features

• Test against the following vulnerabilitie(s):
  • CVE-2018-1000531: JWT signature bypass due to the use of None hashing algorithm (alg=none)
• Guessing attacks against JWT private keys signed with the HS256 hashing algorithm:
  • Brute-force attacks
  • Wordlist attacks

Requirements

jwtcat is fully written in Python 3 and requires a minimum of Python 3.6 in addition to the following libraries:

• coloredlogs
• PyJWT
• tqdm

Installation

1. Clone the repository:

   git clone https://github.com/AresS31/jwtcat
   cd jwtcat

2. (Optional but recommended) Create and activate a new Python virtual environment:

   1. Create the virtual environment:

      python -m venv env

   2. Activate the newly created environment:

      • On POSIX:

        source ./env/bin/activate

      • On Windows:

        ./env/Scripts/Activate.ps1

3. Install dependencies:

   python -m pip install -r requirements.txt

Usage

• To list the available options:

  python jwtcat.py -h

• To list available options specific to brute force attacks:

  python jwtcat.py brute-force -h

  

• To list available options specific to wordlist attacks:

  python jwtcat.py wordlist -h

  

• To test a JWT against CVE-2018-1000531 and HS256 brute-force attacks:

  python jwtcat.py vulnerable -h

  

Roadmap

• Implement additional attack vectors.
• Implement support for multithreading or multiprocessing.
• Implement support for the -tF, --token-file swicth.
• Improve the code logic for:
  • TQDM integration with the logger.
• Improve the script performances.

Changelog

v1.1 - May 2020:

• Added checks to see if JWT is signed with HS256.
• Added checks to see if JWT is vulnerable to CVE-2018-1000531.
• Added potfile options.
• Added support for brute-force attacks.
• Code refactoring.
• Improved the standard output formatting.
• Switched from python-colorlog to coloredlogs.

Sponsor 💖

If you want to support this project and appreciate the time invested in developping, maintening and extending it; consider donating toward my next cup of coffee. ☕

It is easy, all you got to do is press the Sponsor button at the top of this page or alternatively click this link. 💸

Reporting Issues

Found a bug? I would love to squash it! 🐛

Please report all issues on the GitHub issues tracker.

Contributing

You would like to contribute to better this project? 🤩

Please submit all PRs on the GitHub pull requests tracker.

License

See LICENSE.

jwtcat's Issues

Cannot run multi threaded

Hello! I'm trying to run this program but its taking a while to run, but I've noticed that its only using 1 out of 12 available cores on my system.

help

python3 jwtcat.py vulnerable "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcInRlc3RcIixcInJvbGVcIjpcInVzZXJcIn0ifQ.XSPy0jZd8CEtHl2e3C1SjPaewco1tjO3iajbkJy2OFQ"

python3 jwtcat.py vulnerable "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcInRlc3RcIixcInJvbGVcIjpcInVzZXJcIn0ifQ.XSPy0jZd8CEtHl2e3C1SjPaewco1tjO3iajbkJy2OFQ"

jwtcat.py: error: argument --potfile-path: can't open 'jwtpot.potfile': [Errno 13] Permission denied: 'jwtpot.potfile'

module 'jwt' has no attribute 'get_unverified_header'

steps to reproduce:
clone repo
install modules

my jwt:
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NzA3MC9wcml2S2V5LmtleSJ9.eyJ1c2VybmFtZSI6ImpvZSIsImVtYWlsIjoiam9lbWFtNEBnbWFpbC5jb20iLCJhZG1pbl9jYXAiOjB9.g7bFEjAfgronKkdnhrmGOb1S_wOTsC_b1ZGGOBEtfXBpmAu_BK34rghrOusWmUausXzVt9AQz_6zswbx5trmwBMaG1a6_6UjDdDoWftzyI4NK05NFBZ17mivCbtx6vmBa-vy1uby3Ig2VEAivUmLPojjVAfSgw_YRm7Ht3nIhOfslzKuPLnM35cDMHJikWRzl0DEBQMNgioj-i2zLs6qe8EYDLC6UDF8wml9vmF1hHsu8VEq99MtaeZW7JLOHCGTiThv4RqhbgvdvY-cjsz0PfeTjHc7HAK2ckT5BFWZG_4dMEPjNmjH-Y6Qz8eoFTbwNta62sJaSK2QpwTcH6jHZx81fdT7gCxEgZBE5LSUCGk-z7wxnQJ7HJ25zRw2pPWAoqe3GdTpLOcWcxiYSwQW9yGqG2r5vkIdPm-fjKvkDR4F8VOh0X5xR_trvyvUKgQm6EPQ9HPffVNrdx0lJk5obpI0aVkOJsxA_jR-XC1pgzCVcPg2wIfLm5hSQrL1QHi9c0PrULpi172gBO-NRWiWdHw0Vv-1YstCi0aKFAupVqfZRNK7xJAQHI8rXMddZm_UKQseK6znhZQPRoK2_1smjI2IFfeqCV7MG_aYmN5KZkZtyzoOrTQ8xq1zAMleB1xWAZvxQ8Scqt_iH9qZWWityc0iFNTUGiyuP5zLGEW05r8
error:
2021-04-17 22:18:01,658 razerblade main[70996] ERROR module 'jwt' has no attribute 'get_unverified_header

Warning about the warn method

/usr/bin/jwtcat:110: DeprecationWarning: The 'warn' method is deprecated, use 'warning' instead
  logger.warn("Pour yourself some coffee, this might take a while..." )

jwtcat/jwtcat.py

Line 110 in 818cae2

logger.warn("Pour yourself some coffee, this might take a while..." )

Not Abel to crack some tokens, were as other cracker can crack the token.

crackjwt.py script ==> can crack any token.

Note Secret Key is: 1234567890

$ python3 jwtcat.py -t "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.Fw4maeqOtL8pPwiI2_VzYBo4JQ91P1Ow3X3hNqx2wPg" -v -w ~/passwords_long.txt

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#jwtcat

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

SyntaxError: invalid syntax

I'm getting this error when running the script, any ideas?

Thanks!

UTF-8 problem

Hi, i have an issue which is when i use rockyou.txt as wordlist, the utf-8 exception occurs, the problem is like down below:

2020-06-23 10:35:31,600 username __main__[138343] WARNING For attacking complex JWT, it is best to use compiled, GPU accelerated password crackers such as Hashcat and John the Ripper which offer more advanced techniques such as raw brute forcing, rules-based, and mask attacks.
2020-06-23 10:35:31,600 username __main__[138343] INFO Pour yourself a cup (or two) of ☕ as this operation might take a while depending on the size of your wordlist.
2020-06-23 10:35:31,671 username __main__[138343] ERROR 'utf-8' codec can't decode byte 0xf1 in position 923: invalid continuation byte```

Please consider fixing this problem. Thanks in advanced.

ERROR __init__() got an unexpected keyword argument 'required'

exzed@recon:~/jwtcat# python3 jwtcat.py brute-force --increment-min 3 --increment-max 3 "JWT"
2020-10-29 00:37:45,939 recon main[22782] ERROR init() got an unexpected keyword argument 'required'