JWT Security Analyzer

Verification pipeline for detecting common JWT security vulnerabilities using industry-standard tools.

Tools Used

1. jwt_tool - Comprehensive vulnerability testing
2. jwt-hack - Quick security scan
3. jwt-cracker - Weak secret detection (10s timeout)

Usage

docker build -t jwt-analyzer .

docker run --rm jwt-analyzer <JWT_TOKEN>

docker run --rm -e CRACK_TIMEOUT=30 jwt-analyzer <JWT_TOKEN>

References

• JWT mistakes & breaches
• JWT critical flaws
• Real world JWT vulnerabilities
• CVE-2015-9235 - Algorithm confusion vulnerability