hunt-jwt-crypto
可发现直接导致权限提升的高危认证漏洞
可用于伪造令牌和未授权访问，存在滥用风险
检测可伪造 JWT 的签名/配置弱点（alg:none、RS→HS 等）
找出能伪造 JWT 的签名或配置弱点，比如 alg:none、RS→HS 等导致的 key-confusion。用在应用通过 JSON Web Token（像以 eyJ 开头的 Bearer token、cookie）做认证的场景。特别危险的是一旦可伪造，就能冒充任意用户或管理员，属于高危安全问题。
▸ 展开 SKILL.md 英文原文
Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-jwt-crypto/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-jwt-crypto/SKILL.md"# HUNT-JWT-CRYPTO — Forgeable JSON Web Tokens (A04 Cryptographic Failures) ## What actually pays A JWT is `header.payload.signature`, each base64url. The signature is the only thing stopping you from editing the payload (your identity/role) and replaying it. It pays **High/Critical** when the verifier can be tricked into accepting a token you forged — so you become another user or an admin without their secret. Two classic, generic verifier flaws: - **`alg:none`** — the verifier trusts the token's own `alg` header. Set `alg:"none"`, drop the signature, edit the payload (e.g. `role:"admin"`, another user's `id`/`email`). A broken verifier skips signature checking. - **RS256 → HS256 ke