Everything you wanted to know about working with and testing JWTs and JWKs
summary
Creates and decodes JWTs with a PowerShell module, signs with x509 and publishes a JWKS via an Azure Function, and validates with new Json web token and test Json web token showing signature, exp, iss and aud checks. Demonstrates exploitation: alg=none signature stripping, embedding a jwk/jku/x5c/x5u in the header (the “Everything Bagel”), HMAC secret brute forcing, and Kubernetes Secrets lacking expiry. Builds live demos and tooling that reproduce vulnerabilities and shows which fixes (whitelisting algorithms, always verify signatures, validate at every endpoint) actually work.
AI-written summary · about
chapters (14)
- 0:00JWTs and JWKs intro
- 10:07Creating JWTs in PowerShell
- 15:08Validating JWTs with public keys
- 17:24Testing JWTs against JWK sets
- 21:16JWT API vulnerabilities
- 23:25Signature stripping attacks
- 29:50JWK header injection
- 32:14Everything Bagel attack demo
- 36:24OCTA non-algorithm flaw
- 37:27Custom JWT for pentesting
- 39:14HMAC brute-force risks
- 42:41JWTs with GraphQL
- 43:44Kubernetes JWT risks
- 46:33Securing JWT validation
