apileaks v0.2.1

This release ships a complete JWT security testing toolkit, both as a standalone CLI and as the owasp auth automated scanner (OWASP API2 — Broken Authentication).

JWT CLI (apileaks jwt)
A dedicated jwt command group with the following subcommands:

Command	Description
jwt decode	Decode any JWT and display header, payload, and signature
jwt encode	Encode a new token with custom header/payload (HS256 or RSA)
jwt verify	Verify a token signature against a secret, key file, PEM, or JWKS
jwt genkey	Generate RSA or EC keypairs for testing
jwt jwks-to-key	Reconstruct a PEM public key from a JWKS endpoint
jwt brute-secret	Brute-force weak HMAC secrets against a wordlist
jwt test-alg-none	Probe endpoints for alg:none acceptance (signature bypass)
jwt test-null-signature	Probe for null/empty signature acceptance
jwt test-alg-confusion	RS256 → HS256 algorithm confusion attack using the server's public key
jwt test-kid-injection	kid header injection (path traversal / SQL injection payloads)
jwt test-jwks-spoof	Spoof a jku / x5u header to point to attacker-controlled JWKS
jwt test-inline-jwks	Embed a self-signed JWKS inline in the token header
jwt attack-test	Run all attack vectors sequentially against a target endpoint and save full report

Automated detection (owasp auth --jwt-testing)
The owasp auth module now detects the following JWT findings automatically:

JWT_WEAK_SECRET — HMAC secret brute-forced against a bundled wordlist (severity: HIGH)
JWT_NONE_ALGORITHM — endpoint accepts a token with alg:none (severity: CRITICAL)
JWT_NO_EXPIRATION — token is issued without an exp claim (severity: HIGH)
JWT_EXPIRED_TOKEN_ACCEPTED — endpoint accepts a token past its expiration (severity: HIGH)
JWT_TOKEN_NOT_INVALIDATED_AFTER_LOGOUT — token remains valid after calling the logout endpoint (severity: HIGH)
JWT_ALGORITHM_CONFUSION — RS256 public key used as HMAC secret to forge a valid HS256 token (severity: CRITICAL)
JWT_MISSING_EXP_CLAIM / JWT_MISSING_ISS_CLAIM / JWT_MISSING_AUD_CLAIM / JWT_MISSING_JTI_CLAIM — static claim hygiene checks
JWT_EXCESSIVE_TOKEN_LIFETIME — token lifetime exceeds the configured threshold
ECDSA Psychic Signature (CVE-2022-21449) — null r=0, s=0 signature probe for ES256/384/512
Crypto support
HMAC: HS256, HS384, HS512
RSA: RS256, RS384, RS512, PS256, PS384, PS512
ECDSA: ES256 (P-256), ES384 (P-384), ES512 (P-521)
JWK reconstruction from JWKS endpoints (RSA and EC)
PEM/DER key loading with certificate fallback