Skip to content
Get packs

Offensive JWT Attack Checklist

Walks an agent through testing JWT-based login systems for common token-forgery and auth-bypass flaws.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

JWTs are signed tokens that web and mobile apps use to prove who you are after logging in. This skill gives the agent a structured penetration-testing checklist for attacking those tokens: trying to forge them with weak or missing signatures, swapping signing algorithms, abusing key-reference headers, and checking where apps store tokens on phones. Once installed, the agent works through these techniques step by step and explains how each one applies to the target it is testing.

Great for

  • Security professionals running authorized penetration tests on web or mobile apps that use JWT authentication
  • Developers or students learning how JWT authentication fails so they can harden their own implementations
  • Bug bounty hunters working within a program's published scope

Skip it if

  • Testing systems you do not own or have written permission to test, since the checklist describes active attacks that can be illegal and cause harm
  • Production systems without a coordinated test window, because some techniques such as brute-forcing secrets or timing requests generate heavy traffic
  • Simply verifying that your own JWT code is correct; a secure-coding or library-review guide is more direct for that

Try asking

  • “Check this decoded JWT header for risky kid, jku or jwk parameters and tell me which tests to run against our staging API”
  • “Walk me through an algorithm confusion test (RS256 to HS256) against our authorized test environment”
  • “Create a checklist for auditing how our Android app stores JWTs in SharedPreferences”
  • “Explain which JWT misconfigurations a code reviewer should look for in our token validation logic”
Step-by-step guide: how to use Offensive JWT Attack ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-jwt.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-jwt.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-jwt.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against systems you are explicitly authorized to test, and state the scope and authorization in your request.
  • Give the agent a decoded token header and the API endpoints in scope so it can prioritise tests instead of listing everything.
  • Treat the commands and scripts in the skill as templates: review them and change the placeholder targets before running anything.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.