How to pentest oAuth2/oidc clients

Question

imagine the following problem:

As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc.

While I can do these tests all manually, I am sure that there is also an automated way, but I can't find it via google or other means.

Is there such a tool already available?

Answer 1

There is a JWT attack playbook. A simple yet effective attack methodology is developed and automated by "ticarpi" :

The Setup:

• Find JWT tokens
• Identify a test page
• Check that your test cases work (replay the token)

The simple checks

• Is it required?
• Is it checked?
• Is it persistent? (Does it continue working after failed tokens are sent)
• Where is it created?
• Are the claims processed before/despite validation?
• Weak HMAC secret used as a key

The basic exploits

• 'none' Algorithm (CVE-2015-9235)
• RSA Key Confusion (CVE-2016-5431)
• JWKS Injection (CVE-2018-0114)
• null signature (CVE-2020-28042)

The advanced tests

• "kid" issues - reveal key
• "kid" issues - path traversal
• URL Tampering Attacks
• JWKS Spoofing

Extra checks

• Cross-service relay attacks
• Does the expiry get checked?

These checks and more could be conducted by jwt_tool

Ex:

python3 jwt_tool.py -t https://api.test.com/v1/apps -rh "Authorization: Bearer token"  -M pb