lmammino / jwt-cracker

Simple HS256, HS384 & HS512 JWT token brute force cracker.
https://lmammino.github.io/jwt-cracker/
MIT License
1.05k stars 165 forks source link

Change replace method in generateSignature #13

Closed BigFax closed 4 years ago

BigFax commented 4 years ago

replace method doesn't make a replacement when the parameter is a string. It converts it to a Regex without the g flag. The consequence is that it will just replace the first occurrence found in the string. If signatures have mutliple =, + or \ after convertion, just the first occurrence will be replaced and the signatures comparaison will fail.

To make a real string replacement, we need to do string.split('=').join(''); or to pass directly a Regex with g flag.

This PR will fix #9

lmammino commented 4 years ago

Thank you! Great catch!