jwt-security--algorithm-cracker-testerlisted
Install: claude install-skill RMAzrim/opencode-artes
# JWT Security & Algorithm Cracker Tester
## 1. System Architecture & Prerequisites
- Python 3.10+ (stdlib only: `base64`, `json`, `hashlib`, `hmac`, `argparse`, `time`, `datetime`, `os`)
- Optional: `cryptography` package for RS256 signature verification (skipped gracefully if absent)
- Target: an intercepted JWT string plus an optional wordlist file and public key (PEM) location
- Wordlist format: one candidate secret per line (plain text)
## 2. Input/Output Data Contracts
**Input (CLI args):**
```json
{
"type": "object",
"properties": {
"token": { "type": "string", "description": "JWT to analyze (three dot-separated base64url segments)" },
"wordlist": { "type": "string", "description": "Path to candidate-secret wordlist (one per line)" },
"report": { "type": "string", "description": "Output JSON report path", "default": "./jwt_report.json" },
"pem": { "type": "string", "description": "Optional RSA public key PEM file used for key-confusion test" }
},
"required": ["token"]
}
```
**Output artifact:**
- `{report}` — JSON with `token_analysis`, `none_bypass`, `secret_cracked`, `claims_validation`, `key_confusion`
## 3. Production Reference Implementation
```python
#!/usr/bin/env python3
"""JWT Security & Algorithm Cracker Tester — manual JWT analysis, none-bypass, secret cracking, key confusion."""
import base64
import json
import hmac
import hashlib
import argparse
import os
import time
from datetime import datetime, timezone
from pathlib import