Offensive JWT (defensive testing)
Runs JWT attack techniques like algorithm confusion and key injection for pentesting.
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 13, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Jul 19, 2026 · 8ac0987
Authorized-pentest/CTF JWT-security methodology skill (alg:none & RS256->HS256 confusion, weak-HMAC cracking, kid/jku/jwk header injection, mobile token storage), tested defensively on a locally-minted throwaway token pair with no external hosts and no weaponized tooling. Verbatim install is clean: single-file SKILL.md, strict-valid YAML frontmatter, no missing references; docs are accurate with only mild category-level overclaim. In the A/B, the skill and the no-skill base arm both correctly decoded the tokens and identified all three planted weaknesses (alg:none/unpinned algorithm, weak HS256 secret, missing iss/aud) with correct defensive fixes, so the skill added no measurable output lift on this task.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 4/5
- Output vs. baseline 5/10
- Docs & honesty 4/5
What Offensive JWT (defensive testing) does
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or…
How to install Offensive JWT (defensive testing)
git clone https://github.com/SnailSploit/Claude-Red
cd Claude-Red
mkdir -p ~/.claude/skills
cp -r Skills/auth/offensive-jwt ~/.claude/skills/offensive-jwt
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Offensive JWT (defensive testing)
-
/offensive-jwtRuns JWT attack techniques like algorithm confusion and key injection for pentesting.
It also activates on plain-language prompts like these:
-
Test this JWT for algorithm confusion vulnerabilities -
Try to brute-force the HMAC secret on this token -
Check for kid parameter injection in our auth tokens
Frequently asked questions
- Is the Offensive JWT (defensive testing) skill free?
- Yes. The skill itself is free from SnailSploit/Claude-Red. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Offensive JWT (defensive testing) work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 13, 2026. Verdict: Works with setup. Authorized-pentest/CTF JWT-security methodology skill (alg:none & RS256->HS256 confusion, weak-HMAC cracking, kid/jku/jwk header injection, mobile token storage), tested defensively on a locally-minted throwaway token pair with no external hosts and no weaponized tooling. Verbatim install is clean: single-file SKILL.md, strict-valid YAML frontmatter, no missing references; docs are accurate with only mild category-level overclaim. In the A/B, the skill and the no-skill base arm both correctly decoded the tokens and identified all three planted weaknesses (alg:none/unpinned algorithm, weak HS256 secret, missing iss/aud) with correct defensive fixes, so the skill added no measurable output lift on this task.
- What is the Offensive JWT (defensive testing) SkillProof Score?
- 7.2/10 — installs cleanly 5/5, triggers reliably 4/5, output vs. baseline 5/10, docs & honesty 4/5.
- How do I install Offensive JWT (defensive testing)?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Offensive JWT (defensive testing) with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.