Individual skill
performing-jwt-none-algorithm-attack
Execute and test the JWT none algorithm attack, crafting tokens with the alg header set to none using PyJWT and an intercepting proxy (Burp Suite/mitmproxy) to bypass signature verification and forge arbitrary claims. Use during authorized penetration tests or security assessments of applications that use JWT for authentication or authorization, to validate that the server rejects unsigned tokens.
skills/performing-jwt-none-algorithm-attack/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,925
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- jwt Declared skill tag
- none-algorithm Declared skill tag
- authentication-bypass Declared skill tag
- token-manipulation Declared skill tag
- signature-bypass Declared skill tag
- penetration-testing Declared skill tag
- owasp Declared skill tag
- web-security Declared skill tag
- security Derived category
- testing Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 12,428 bytesSKILL.mdcore · 12,428 bytesSKILL.mdcore · 12,428 bytesSKILL.mdcore · 12,428 bytesSKILL.mdcore · 12,428 bytesSKILL.mdcore · 12,428 bytesreferences/api-reference.mddoc · 1,710 bytesscripts/agent.pyruns · 7,096 bytes
Read excerpt
# Performing JWT None Algorithm Attack
## Overview
The JWT none algorithm attack exploits a vulnerability in JSON Web Token libraries that accept tokens with the `alg` header set to `none`, effectively bypassing signature verification. When a server processes a JWT with `"alg": "none"`, it treats the token as valid without checking any cryptographic signature, allowing attackers to forge tokens with arbitrary claims such as escalated privileges, impersonated users, or extended expiration times. This vulnerability was first disclosed by Tim McLean in 2015 and has affected multiple JWT libraries across languages.
## When to Use
- When conducting security assessments that involve performing jwt none algorithm attack
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
