0

imagine the following problem:

As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc.

While I can do these tests all manually, I am sure that there is also an automated way, but I can't find it via google or other means.

Is there such a tool already available?

1 Answer 1

2

There is a JWT attack playbook. A simple yet effective attack methodology is developed and automated by "ticarpi" :

The Setup:

  • Find JWT tokens
  • Identify a test page
  • Check that your test cases work (replay the token)

The simple checks

  • Is it required?
  • Is it checked?
  • Is it persistent? (Does it continue working after failed tokens are sent)
  • Where is it created?
  • Are the claims processed before/despite validation?
  • Weak HMAC secret used as a key

The basic exploits

  • 'none' Algorithm (CVE-2015-9235)
  • RSA Key Confusion (CVE-2016-5431)
  • JWKS Injection (CVE-2018-0114)
  • null signature (CVE-2020-28042)

The advanced tests

  • "kid" issues - reveal key
  • "kid" issues - path traversal
  • URL Tampering Attacks
  • JWKS Spoofing

Extra checks

  • Cross-service relay attacks
  • Does the expiry get checked?

These checks and more could be conducted by jwt_tool

Ex:

python3 jwt_tool.py -t https://api.test.com/v1/apps -rh "Authorization: Bearer token"  -M pb
6
  • thanx for this answer, I fear that those modified tokes will be rejected because of a wrong or missing signature. How will I approach this?
    – rdmueller
    Jul 9, 2021 at 7:50
  • 1
    Sorry but I don't get your concern! It's a good news if the modified token is rejected isn't it? Jul 9, 2021 at 7:52
  • if the token is already rejected because of a wrong signature, there is no way to test for the other issues like expiry check.
    – rdmueller
    Jul 9, 2021 at 8:32
  • Ah, no the tool keep the "original" token and make a change/test a time, so you don't need to handle this, the script do it. I Edited the response to include a "working" command Jul 9, 2021 at 9:01
  • 1
    There also is the OIDC certification test on openID.net/certification … especially handy if you want to validate more the total implementation that just the tokens.
    – LvB
    Jul 9, 2021 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.