lmammino / jwt-cracker Goto Github PK

View Code? Open in Web Editor NEW

964.0 9.0 159.0 304 KB

Simple HS256, HS384 & HS512 JWT token brute force cracker.

Home Page: https://lmammino.github.io/jwt-cracker/

License: MIT License

JavaScript 100.00%

jwt jwt-cracker secrets alphabet cracker brute-force bruteforce brute-force-attacks javascript nodejs

jwt-cracker's Introduction

jwt-cracker

Simple HS256, HS384 & HS512 JWT token brute force cracker.

Effective only to crack JWT tokens with weak secrets. Recommendation: Use strong long secrets or RS256 tokens.

Install

With npm:

npm install --global jwt-cracker

Usage

From command line:

jwt-cracker -t <token> [-a <alphabet>] [--max <maxLength>] [-d <dictionaryFilePath>] [-f]

Where:

token: the full HS256-512 JWT token string to crack
alphabet: the alphabet to use for the brute force (default: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
maxLength: the max length of the string generated during the brute force (default: 12)
dictionaryFilePath: path to a list of passwords (one per line) to use instead of brute force
force: force script to execute when the token isn't valid

Requirements

This script requires Node.js version 16.0.0 or higher

Example

Cracking the default jwt.io example:

jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -a abcdefghijklmnopqrstuwxyz --max 6

It takes about 2 hours in a Macbook Pro (2.5GHz quad-core Intel Core i7).

Or using a list of passwords taken from https://github.com/danielmiessler/SecLists

jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -d darkweb2017-top10000.txt

It takes less than a second.

Contributing

Everyone is very welcome to contribute to this project. You can contribute just by submitting bugs or suggesting improvements by opening an issue on GitHub.

License

Licensed under MIT License. © Luciano Mammino.

jwt-cracker's People

Contributors

Stargazers

Watchers

Forkers

madindustries hax0rg1rl kbahaxor tim1512 songofhack manishpathak99 grukz lamkeysing92 minkione mvetsch robdwaller nickcano piyush-repo marianojabdala techlord-rce noraj ludolfs shahid1996 derekkddj zutobg fabioguelfi d3c3ptic0n cccaaasser mm86133 xmrseo arryboom linglong0523 parzival-3 bswdiy zmlsw2006 x0james modulexcite mathiznogoud uzeyirdestan zhaojianxin1234 sry309 dingxh317 nimrodolev 5l1v3r1 itsrbpandit ilkkai mohit0 chemouri arukaminado hugojerez slowmistio wab-mm eslamelhadedy papadope-zz zorroroot iskandarsaleh peterg75 bigfax xen0byte joannazhong93 nathannlu tenacity-mc eegles gemboxteam nosorry perrym tcarters hackertachi 0x0000141 scent2d amesianx vimukt macknight lcsouzamenezes latkes harikirank securitycomplicance huangzccn davidliu88 ercgit priyanshuxo manuchowdare sergiogarciasec emranjk abdulmalikjalloh matrixsociety t3l3sk vv4r1ock jarombrown kamalares nap3xd monish4033 meetgyn hack-supriya jeromeyoung pitboy26 w12rr hartl3y94 sysdba oakkaya dpkprmr ahzahr 4k4xs4ph1r3 dyetto christofersimbar

jwt-cracker's Issues

wordlist is loaded entirely into ram

When using crackstation's wordlist (which is about 15GB) I went into swapping hell but luckily the python interpreter was nice and killed the process. Is there an easy way to load the wordlist in batches?

test

error on successful npm installation of jwt-cracker

jwt-cracker : The term 'jwt-cracker' is not recognized as the name of a cmdlet, function,
script file, or operable program. Check the spelling of the name, or if a path was
included, verify that the path is correct and try again.

How can the command not be recognized if the packages are installed ?

Error: Cannot find module '${PWD}/process-chunk.js'

Related to #21

Error when running jwt-cracker

Running:

sudo jwt-cracker eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmbGFnIjoiQlRMe180X0V5ZXN9IiwiaWF0Ijo5MDAwMDAwMCwibmFtZSI6IkdyZWF0RXhwIiwiYWRtaW4iOnRydWV9.jbkZHll_W17BOALT95JQ17glHBj9nY-oWhT1uiahtv8 6

Getting:

file:///usr/local/lib/node_modules/jwt-cracker/index.js:7
const pkg = JSON.parse(await readFile(new URL('./package.json', import.meta.url)))
                       ^^^^^

SyntaxError: Unexpected reserved word

Whether to support jjwt format

installation issue

npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/jwt-crackerp - Not found
npm ERR! 404
npm ERR! 404 'jwt-crackerp@latest' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

npm ERR! A complete log of this run can be found in:
npm ERR! /root/.npm/_logs/2022-02-03T15_53_29_869Z-debug.log

Sintaxis error

$jwt-cracker "..." "demo" 4

/usr/local/lib/node_modules/jwt-cracker/index.js:49
const [header, payload, signature] = token.split('.');
      ^

SyntaxError: Unexpected token [
    at exports.runInThisContext (vm.js:53:16)
    at Module._compile (module.js:374:25)
    at Object.Module._extensions..js (module.js:417:10)
    at Module.load (module.js:344:32)
    at Function.Module._load (module.js:301:12)
    at Function.Module.runMain (module.js:442:10)
    at startup (node.js:136:18)
    at node.js:966:3

SECRET NOT FOUND

I don't know why it doesn't work.

jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJma2ZmIiwiZW1haWwiOiJjZGNkQGRzZnMuY29tIiwibmFtZSI6ImZsZGZrZHNrZmQiLCJpY 
XQiOjE1OTI4MDE5MTZ9.Cvzj0tVtVGc60xvqLdyasYf6gF8QLi8HQCKlxw9nBk4" 4

SECRET NOT FOUND
Time taken (sec): 0.01
Attempts: 12

Here is the stack trace:

/usr/local/lib/node_modules/jwt-cracker/index.js:49
const [header, payload, signature] = token.split('.');
      ^

SyntaxError: Unexpected token [
    at exports.runInThisContext (vm.js:53:16)
    at Module._compile (module.js:373:25)
    at Object.Module._extensions..js (module.js:416:10)
    at Module.load (module.js:343:32)
    at Function.Module._load (module.js:300:12)
    at Function.Module.runMain (module.js:441:10)
    at startup (node.js:139:18)
    at node.js:974:3

SyntaxError: Unexpected token

Hi,

I ran into this issue testing this cracker with the default jwt token.

ubuntu:~/Desktop/api_testing/jwt-cracker$ jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789" 6
/usr/local/lib/node_modules/jwt-cracker/index.js:49
const [header, payload, signature] = token.split('.');
      ^

SyntaxError: Unexpected token [
    at exports.runInThisContext (vm.js:53:16)
    at Module._compile (module.js:374:25)
    at Object.Module._extensions..js (module.js:417:10)
    at Module.load (module.js:344:32)
    at Function.Module._load (module.js:301:12)
    at Function.Module.runMain (module.js:442:10)
    at startup (node.js:136:18)
    at node.js:966:3

System: uname -a
Linux ubuntu 4.8.0-56-generic #61-Ubuntu SMP Wed Jun 14 08:15:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
npm -v -> 3.5.2

node -v -> 4.2.6

Any ideas how to fix it?

Cheers.