api-auth-and-jwt-abuse
yaklang/hack-skills
Test JWT tokens, API keys, and auth headers for trust boundary weaknesses, claim abuse, and rate-limit bypasses.
What is api-auth-and-jwt-abuse?
Playbook for identifying and exploiting API authentication flaws in JWT, bearer tokens, and API keys. Use when testing token trust boundaries, claim misuse, header spoofing, and rate-limit bypass techniques.
- Inspect JWT structure (alg, kid, jku, x5u) and privilege claims for trust issues
- Test algorithm confusion attacks (alg:none, RS256→HS256 switching)
- Identify kid lookup injection and remote key fetch vulnerabilities
- Detect weak secrets and offline token cracking opportunities
- Bypass rate limits using header spoofing (X-Forwarded-For, X-Real-IP, Forwarded)
- Exploit batch/mass-assignment abuse in GraphQL and JSON APIs
How to install api-auth-and-jwt-abuse
npx skills add https://github.com/yaklang/hack-skills --skill api-auth-and-jwt-abuseHow to use api-auth-and-jwt-abuse
- 1.Intercept API requests and extract bearer tokens or JWT tokens
- 2.Decode the JWT header and payload to inspect alg, kid, jku, x5u, and privilege claims
- 3.Test algorithm confusion by creating an unsigned token (alg:none) or switching RS256 to HS256
- 4.Attempt to inject or traverse the kid parameter to load alternative keys
- 5.Try rate-limit bypass headers (X-Forwarded-For, X-Real-IP, Forwarded) on rate-limited endpoints
- 6.Test batch/mass-assignment by sending arrays of mutations or repeated requests in a single payload
- 7.Attempt to crack weak secrets offline using targeted wordlists if token inspection reveals weak entropy
Use cases
- Test a JWT endpoint for algorithm confusion by switching RS256 to HS256 with the public key as secret
- Attempt rate-limit bypass by rotating X-Forwarded-For headers or User-Agent values
- Check for mass-assignment vulnerabilities by injecting role, isAdmin, or permissions fields in API requests
- Exploit GraphQL batch mutations to bypass authentication or rate limits on password reset endpoints
- Inspect kid parameter in JWT headers for path traversal or injection leading to key confusion
- API security testers
- Penetration testers evaluating authentication boundaries
- Bug bounty hunters targeting token-based auth systems
- Security engineers auditing JWT and OAuth implementations
api-auth-and-jwt-abuse FAQ
alg:none removes signature verification entirely (unsigned token with trailing dot). RS256→HS256 confusion tricks the server into using the public key as the HMAC secret, allowing an attacker to forge valid signatures.
Modify the kid parameter in the JWT header to attempt path traversal (e.g., ../../../etc/passwd) or inject SQL/command syntax. Check if the server loads an attacker-controlled key or reveals error messages.
Start with X-Forwarded-For, X-Real-IP, and Forwarded headers to spoof source IP. Also try User-Agent rotation and path case/slash variants to bypass rate-limit buckets.
Send arrays of mutations (e.g., multiple login or password-reset calls) in a single request, or fetch bulk objects with varying IDs to bypass per-request rate limits.
Try injecting role, isAdmin, admin, verified, plan, tier, permissions, org, and owner fields in API payloads to escalate privileges or modify account attributes.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: api-auth-and-jwt-abuse description: >- API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.
SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits
AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.
1. TOKEN TRIAGE
Inspect:
alg,kid,jku,x5u- role, org, tenant, scope, or privilege claims
- issuer and audience mismatches
- reuse of mobile and web tokens across products
2. QUICK ATTACK PICKS
| Pattern | First Test |
|---|---|
alg:none acceptance | unsigned token with trailing dot |
| RS256 confusion | switch to HS256 using public key as secret |
kid lookup trust | path traversal or injection in kid |
| remote key fetch trust | attacker-controlled jku or x5u |
| weak secret | offline crack with targeted wordlists |
3. HIDDEN FIELDS AND BATCH ABUSE
Mass assignment field picks
role
isAdmin
admin
verified
plan
tier
permissions
org
owner
Rate limit and batch abuse picks
X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9
GraphQL or JSON batch abuse candidates:
- arrays of login mutations
- bulk object fetches with varying IDs
- repeated password reset or verification calls in one request
4. RATE LIMIT BYPASS FAMILIES
X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants
5. NEXT ROUTING
- For GraphQL batching and hidden parameters: graphql and hidden parameters
- For default credential and brute-force planning: authentication bypass
- For full JWT and OAuth depth: jwt oauth token attacks
- For OAuth or OIDC configuration flaws in browser and SSO flows: oauth oidc misconfiguration
- For credentialed browser reads and origin trust bugs: cors cross origin misconfiguration
Related skills
More from yaklang/hack-skills and the wider catalog.
api-authorization-and-bola
Test API authorization, BOLA, BFLA, and mass assignment vulnerabilities across object and function access.
api-recon-and-docs
Discover API endpoints, schemas, versions, and hidden documentation surface before testing.
api-sec
Entry point router for API security testing—choose between recon, authorization, token abuse, and GraphQL workflows.
arbitrary-write-to-rce
Convert arbitrary write primitives into code execution by targeting GOT, hooks, _IO_FILE, exit_funcs, TLS_dtor_list, and other glibc structures.
auth-sec
Entry point router for authentication, authorization, sessions, and identity protocol testing.
authbypass-authentication-flaws
Authentication bypass testing playbook for login flows, password reset, MFA, and token flaws.