ticarpi / jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens
GNU General Public License v3.0
5.46k stars 670 forks source link

Scanning modes don't work with JWT already containing a "jku" header #90

Open h49nakxs opened 1 year ago

h49nakxs commented 1 year ago

Hello,

Thanks for your great tool, really handy to test JWT :+1:

Just want to report a small issue. The scanning modes "-M pb" and "-M at" don't work with a JWT in which there's already a "jku" header.

The problem lies starting 1432 :

    try:
        origjku = headDict["jku"]
    except:
        origjku = False
        if config['services']['jwksloc']:
            jku = config['services']['jwksloc']
        else:
            jku = config['services']['jwksdynamic']
    newContents, newSig = exportJWKS(jku)
    jwtOut(newContents+"."+newSig, "Exploit: Spoof JWKS (-X s)", "Signed with JWKS at "+jku)

The variable "jku" is never set if there's already a "jku" header inside the token, thus the program throws an error.