Cookie Forge

JSON Web Tokens (JWTs) are the backbone of authentication in modern web applications, and JWT hacking has become a critical area of security testing. JWTs allow servers to issue self-contained tokens that encode user identity and permissions, which the client stores and sends with each request - typically in cookies. However, improper JWT implementation creates serious security vulnerabilities that attackers can exploit for privilege escalation and authentication bypass.

Understanding JWT Structure

A JWT consists of three Base64-encoded parts separated by dots: the header, payload, and signature. The header specifies the signing algorithm (e.g., HS256, RS256). The payload contains claims - key-value pairs that typically include user identity, roles, and expiration time. The signature verifies that the token has not been tampered with. Understanding this structure is the first step in JWT hacking, as each component presents potential attack surfaces.

Common JWT Vulnerabilities

Several well-known vulnerabilities affect JWT implementations. The algorithm confusion attack exploits servers that accept the "none" algorithm, allowing attackers to forge unsigned tokens. The RS256-to-HS256 switch tricks servers into using a public key as an HMAC secret. Weak signing secrets can be cracked offline using tools like hashcat or john. Additionally, servers that fail to validate claims like expiration time, issuer, or audience accept tokens that should be rejected. Cookie-based JWT storage adds further risks if cookies lack proper security flags.

JWT Security Best Practices

Secure JWT implementation requires using strong signing secrets (at least 256 bits of entropy), validating all claims on every request, explicitly specifying allowed algorithms to prevent algorithm confusion attacks, setting appropriate token expiration times, and implementing proper token revocation mechanisms. For cookie-based JWT storage, developers must set the HttpOnly, Secure, and SameSite flags to prevent client-side access and cross-site attacks.