Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
JWT
JSON Web Tokens are self-contained credentials — the server trusts what's inside the token if the signature check fails. Algorithm confusion, weak secrets, and unverified claims all turn a valid session into an arbitrary one.
Severity guide
Critical when an algorithm/verification bypass yields another user's session; high for weak-secret signing (forge any claim); medium for sensitive data leakage in payloads.
Where to look
entry points to test first01
Authorization headers
Bearer eyJ... — decode every JWT you receive, always. Header first, then payload claims.
02
Cookies & localStorage
Session cookies named token/jwt/session and SPA localStorage — same tokens, same bugs.
03
Password-reset links
Reset tokens as JWTs — expiry/audience checks are where these fail.
04
API keys & service tokens
Internal service-to-service tokens with long lifetimes and no rotation.
05
OAuth/OIDC flows
id_token verification bugs — the alg confusion pattern originates here.
How to hunt it
in order, start to finishDecode the three parts
header.payload.signature (base64url). Read alg, check for sensitive data in the payload — JWTs are signed, not encrypted.
Try alg:none
Change the header alg to none, drop the signature, keep the claims. Servers that accept it trust you completely.
Brute-force weak secrets
HS256 with a short password is crackable offline in seconds — hashcat/jwt_tool with a wordlist.
Tamper claims with the right key confusion
RS256→HS256 confusion makes the server verify with its own public key as an HMAC secret. kid injection can point at a file you control.
Test claim validation gaps
Expired tokens accepted? exp removed? audience/issuer unchecked? Each missing check is a replay/forgery primitive — document which check is absent.
Escalate to account takeover
Forge a token with another user's sub/email once verification is broken — request their data, prove the takeover, report.
Filter & validation bypasses
when your first tries get blocked- 01alg:none rejected? Try none/None/NONCE case variants and alg:'' empty strings — parser quirks abound.
- 02RS256 server-only? Send the public key as an HS256 HMAC secret (key confusion) — old jwt libs accept it.
- 03Key pinned? kid header injection: kid: ../../dev/null with an empty-string secret, or SQLi/path-traversal inside kid.
- 04Claims validated? Reuse tokens across endpoints — validation is often applied on one route, forgotten on another.
Impact ladder
what makes it payable- 01Full account impersonation — forge any user's session.
- 02Auth bypass — expired/revoked tokens accepted forever.
- 03Sensitive data leak — payloads carry PII/internal identifiers in cleartext.
- 04Privilege escalation — role/admin claims tampered once signature verification falls.
Payloads
5 · from PayloadsAllTheThingseyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9Standard HS256 header — decode to inspect the algorithm.
{"typ": "JWT", "alg": "HS256"} → {"typ": "JWT", "alg": "none"} + empty signatureThe none-attack rewrite — strip verification entirely.
python3 jwt_tool.py JWT_HERE -X njwt_tool none-attack — rewrites alg to none and strips the signature.
hashcat -a 0 -m 16500 jwt.txt wordlist.txtOffline secret brute-force for HS256 tokens.
"sub":"1234567890", "name":"Amazing Haxx0r", "admin":trueThe claim block to forge once verification is bypassed.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.