jwtaudit

Documentation

Overview

Package jwtaudit implements JWT (JSON Web Token) security auditing.

Reference implementations studied (for algorithm design only, no code copied):

• jwt_tool (MIT): https://github.com/ticarpi/jwt_tool
• jwtcrack / jwt-pwn (public research tools)
• CVE-2015-9235 (none algorithm), CVE-2016-10555 (alg confusion): IETF/NVD

What is implemented:

• JWT parsing (header, payload, signature) — RFC 7519
• 8 security checks: 1. None algorithm attack (CVE-2015-9235): alg=none/NONE/None bypasses sig check 2. Algorithm confusion attack (RS256→HS256): asymmetric key used as HMAC secret 3. Weak secret brute-force: checks against a wordlist of 200+ common secrets 4. Key ID (kid) header injection: path traversal and SQL injection in kid 5. Expiry validation: flags tokens with no exp claim or expired tokens 6. Sensitive data in payload: PII/secret patterns in decoded claims 7. "alg: RS256 + public key as HS256 secret" confusion test 8. JWK injection: jwk header parameter injection attempt
• Token extraction from HTTP headers, cookies, URL params, and response body
• io.LimitReader on every body read (dicas.md §5)
• log/slog structured observability (dicas.md §16)
• context propagation and cancellation (guia-go §9)

Index

• type Module
  • func New() *Module
  • func NewWithClient(c *http.Client) *Module
  • func NewWithWordlist(wordlist []string) *Module
  • func (m *Module) Name() string
  • func (m *Module) Run(ctx context.Context, input module.Input) ([]module.Finding, error)
• type Token

Types

type Module

type Module struct {
	// contains filtered or unexported fields
}

Module implements module.Module for JWT security auditing.

func New

func New() *Module

New returns a Module with the built-in configuration.

func NewWithClient

func NewWithClient(c *http.Client) *Module

NewWithClient returns a Module with an injected http.Client (for tests).

func NewWithWordlist

func NewWithWordlist(wordlist []string) *Module

NewWithWordlist returns a Module with a custom wordlist (for tests/extensions).

func (*Module) Name

func (m *Module) Name() string

Name satisfies module.Module.

func (*Module) Run

func (m *Module) Run(ctx context.Context, input module.Input) ([]module.Finding, error)

Run satisfies module.Module. Input.Target or Input.URLs are URLs that may return JWT tokens in responses. Input.RawContent is scanned directly if provided (e.g. pre-fetched response body). Individual JWT strings can be passed in Options["token"].

Options:

"token"      — explicit JWT string to audit (skips HTTP fetch)
"timeout"    — per-request timeout in seconds (default: 15)
"checks"     — comma-separated check names to run (default: all)

type Token

type Token struct {
	Raw       string                 // original JWT string
	Header    map[string]interface{} // decoded header claims
	Payload   map[string]interface{} // decoded payload claims
	Signature []byte                 // raw signature bytes
	Source    string                 // where the token was found (e.g. "header:Authorization", "cookie:session")
}

Token holds a parsed JWT.