Simon McCabe

WAPT. OSCP. OSWP. PGCert. BSc. Linux+. Security+.

...JWT is Cracking! or is it the other way around?...

Steps to Install JWT-Crack

git clone https://github.com/lmammino/jwt-cracker.git

sudo npm install --global jwt-cracker

How to Use JWT-Crack

Below is an example of how to use the program. Essentially, we take our full JWT token, append the characters we wish to brute force with (in this case, the lower-case alphabet), and followed by how many characters we want to try brute forcing.

The formula is:

So a real world example would look like this:

So how do we know if it has been cracked? It'll tell you! Beware, if it's a strong password in any way (e.g alphanumeric) this may take a seriously long time.

If you copy and use my provided JWT, you'll find it's cracked very quickly as it's just 4 characters. Here's a slightly more difficult one for you to try and crack:

Your Challenge...Crack this:

I have been kind and provided you a with reduced character set to speed it up.

Challenge inspired by TryHackMe

Go to top