/jwt-scan
JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan <token> [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f]
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/jwt-scan
Context preview
What this command does when you run it.
JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan <token> [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f]
Command definition
jwt-scan.mddescription: JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan <token> [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f]
/jwt-scan
Forge and analyze JWTs offline. Implements the three highest-paid JWT bugs from the auth skill. All crypto is pure stdlib — no network needed to mint a forgery.
Usage
/jwt-scan <token> --analyze
/jwt-scan <token> --alg-none
/jwt-scan <token> --confuse --public-key pub.pem --set role=admin
/jwt-scan <token> --crack --wordlist wordlists/jwt-secrets.txt
Run directly:
tools/jwt_scanner.py "$TOKEN" --analyze
tools/jwt_scanner.py "$TOKEN" --crack --wordlist secrets.txt
Attacks
| Flag | Attack | When it works | |---|---|---| | `--alg-none` | Strip signature, set `alg` to none/None/NONE/nOnE | verifier honors `alg` from the header | | `--confuse --public-key` | RS256→HS256: re-sign with the server's **public** key as the HMAC secret | verifier calls generic `verify(token, key)` | | `--crack --wordlist` | Brute-force the HS256 secret | weak/guessable signing secret | | `--analyze` | Static: flags `alg=none`, missing `exp`, trust-bearing claims (`role`/`is_admin`/`scope`), `kid` (probe for traversal/SQLi) | always |
`--set key=value` (repeatable) overrides claims in `--alg-none`/`--confuse` forgeries — e.g. `--set role=admin --set sub=1`.
Workflow
1. `--analyze` to read the header/claims and pick an attack. 2. Mint a forgery (`--alg-none` or `--confuse`) with `--set role=admin`. 3. Replay the forged token against an authenticated endpoint — if it's accepted, you have **privilege escalation / auth bypass** (Critical).
Getting the public key for `--confuse`: try `/jwks.json`, `/.well-known/jwks.json`, or extract it from the TLS cert / a verify endpoint.
Read more
description: JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan <token> [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f]
/jwt-scan
Forge and analyze JWTs offline. Implements the three highest-paid JWT bugs from the auth skill. All crypto is pure stdlib — no network needed to mint a forgery.
Usage
/jwt-scan <token> --analyze /jwt-scan <token> --alg-none /jwt-scan <token> --confuse --public-key pub.pem --set role=admin /jwt-scan <token> --crack --wordlist wordlists/jwt-secrets.txt
Run directly:
tools/jwt_scanner.py "$TOKEN" --analyze tools/jwt_scanner.py "$TOKEN" --crack --wordlist secrets.txt
Attacks
| Flag | Attack | When it works | |---|---|---| | `--alg-none` | Strip signature, set `alg` to none/None/NONE/nOnE | verifier honors `alg` from the header | | `--confuse --public-key` | RS256→HS256: re-sign with the server's **public** key as the HMAC secret | verifier calls generic `verify(token, key)` | | `--crack --wordlist` | Brute-force the HS256 secret | weak/guessable signing secret | | `--analyze` | Static: flags `alg=none`, missing `exp`, trust-bearing claims (`role`/`is_admin`/`scope`), `kid` (probe for traversal/SQLi) | always |
`--set key=value` (repeatable) overrides claims in `--alg-none`/`--confuse` forgeries — e.g. `--set role=admin --set sub=1`.
Workflow
1. `--analyze` to read the header/claims and pick an attack. 2. Mint a forgery (`--alg-none` or `--confuse`) with `--set role=admin`. 3. Replay the forged token against an authenticated endpoint — if it's accepted, you have **privilege escalation / auth bypass** (Critical).
Getting the public key for `--confuse`: try `/jwks.json`, `/.well-known/jwks.json`, or extract it from the TLS cert / a verify endpoint.
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.
Repo: shuvonsec/claude-bug-bounty
Other commands on claude-bug-bounty.
- /arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>
Open command - /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /breach-check
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
Open command - /bypass-403
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
Open command