> For the complete documentation index, see [llms.txt](https://www.webhackingtips.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.webhackingtips.com/week-40-jwt-testing.md). # Week 40 - JWT Testing Looking for a quick way to test JSON Web Tokens (JWT's) during an [#AppSec](https://www.linkedin.com/feed/hashtag/?keywords=appsec\&highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6988868624044191744) engagement?\ \ I highly recommend using jwt\_tool! To get it running, just locate a GET request to an authenticated endpoint that uses a JWT in the Authorization header. Then run the following command:\ \ `python3`[`jwt_tool.py`](http://jwt_tool.py) `-M at -t "https[:]//staging[.]client[.]com/api/v3/endpoint" -rh "Authorization: Bearer eyJ0eHAiCiJKV1QiLCJhbGciO…"`\ \ The -M option sets the attack mode; in the above case we set ‘at’ for all tests. The -t option is the target URL. The -rh allows us to specify request headers, in this case, the Authorization request header containing the JWT.\ \ Then let it rip! It will auto-magically test common exploits, claim fuzzing, token misconfigurations, etc. Leaving you more time for that Business Logic!\ \ Let me know what tools you use for [#JWT](https://www.linkedin.com/feed/hashtag/?keywords=jwt\&highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6988868624044191744) testing in the comments below. ![](/files/4G6tErWD2X2YxEvvA2fm)