What is JWT Editing?

JWT editing involves modifying the contents of a JWT token while maintaining its structural integrity. This includes:

• Header modification: Changing algorithm, type, or other header parameters
• Payload modification: Altering claims like user ID, roles, expiration time
• Re-signing: Generating a new signature with a different key or algorithm
• Algorithm confusion: Testing how applications handle algorithm changes

How to Use the JWT Editor

Step 1: Navigate to the Tool

Click on the "✏️ JWT Editor" tab in the main JWTAuditor interface.

Step 2: Load a JWT Token

Paste your JWT token in the "JWT Token to Edit" field and click "Load JWT". The tool will:

• Parse and validate the token structure
• Extract the header and payload
• Display them in editable JSON format
• Set the signature algorithm selector

Step 3: Edit the Header

Modify the header JSON in the Header editor. Common modifications include:

{
  "alg": "none",  // Changed from "HS256"
  "typ": "JWT"
}

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "../../etc/passwd"  // Path traversal attempt
}

Step 4: Edit the Payload

Modify the payload JSON to change claims. Common testing scenarios:

{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",  // Changed from "user"
  "iat": 1516239022,
  "exp": 1516242622
}

{
  "sub": "999999999",  // Changed user ID
  "name": "Administrator",
  "role": "admin",
  "iat": 1516239022,
  "exp": 1516242622
}

Step 5: Configure Signature Options

Choose the signing algorithm and provide the necessary keys:

Step 6: Generate the Modified Token

Click "Generate JWT" to create the modified token. The tool will:

• Validate the JSON syntax
• Update the algorithm in the header
• Generate the appropriate signature
• Display the complete modified JWT

Step 7: Copy and Test

Use the "Copy to Clipboard" button to copy the modified token and test it in your target application.

Common Attack Scenarios

1. Algorithm Confusion Attack

Test if the application accepts tokens with different algorithms:

// Original Header
{
  "alg": "HS256",
  "typ": "JWT"
}

// Modified Header
{
  "alg": "none",
  "typ": "JWT"
}

// Original Header
{
  "alg": "RS256",
  "typ": "JWT"
}

// Modified Header
{
  "alg": "HS256",
  "typ": "JWT"
}

2. Privilege Escalation

Modify user roles and permissions in the payload:

// Original Payload
{
  "sub": "1234567890",
  "name": "Regular User",
  "role": "user",
  "permissions": ["read"]
}

// Modified Payload
{
  "sub": "1234567890",
  "name": "Regular User",
  "role": "admin",
  "permissions": ["read", "write", "delete", "admin"]
}

3. Token Expiration Bypass

Extend or remove expiration times:

// Original Payload (expired)
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622  // Past expiration
}

// Modified Payload (future expiration)
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1915934400  // Year 2030
}

4. User Impersonation

Change user identifiers to impersonate other users:

// Original Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "email": "john@example.com"
}

// Modified Payload
{
  "sub": "0000000001",  // Admin user ID
  "name": "Administrator",
  "email": "admin@example.com"
}

Advanced Features

Signature Verification

The JWT Editor includes a signature verification feature to test if a secret key is correct:

1. Load a JWT token
2. Enter a suspected secret key
3. Click "Verify Signature"
4. The tool will confirm if the key is valid

JSON Validation

The editor automatically validates JSON syntax and provides error messages for invalid JSON structures.

Algorithm Support

JWTAuditor supports all common JWT algorithms:

• none: No signature
• HS256/HS384/HS512: HMAC with SHA-256/384/512
• RS256/RS384/RS512: RSA with SHA-256/384/512

Best Practices

For Penetration Testers

• Always test the original token before modifications
• Start with simple modifications (algorithm change)
• Test each modification separately to identify what works
• Document successful modifications for reporting
• Consider the business impact of successful modifications

For Developers

• Use this tool to test your JWT validation logic
• Verify that your application rejects modified tokens
• Test algorithm confusion scenarios
• Ensure proper signature verification
• Validate all claims thoroughly

Security Testing Checklist

• ☐ Test "none" algorithm acceptance
• ☐ Test HMAC to RSA algorithm confusion
• ☐ Test privilege escalation through role modification
• ☐ Test user impersonation through ID changes
• ☐ Test expiration bypass
• ☐ Test signature verification with invalid keys
• ☐ Test malformed JSON handling

RSA Key Management

Private Key Format

RSA private keys should be in PEM format:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA2Z3QX0BTLS5+o6zXITG3MuHE8PVDRvn1wQ3lTe7YmQsS8U8a
...
-----END RSA PRIVATE KEY-----

Key Generation

You can generate RSA keys using OpenSSL:

# Generate private key
openssl genrsa -out private_key.pem 2048

# Extract public key
openssl rsa -in private_key.pem -pubout -out public_key.pem

Testing with Public Keys

For algorithm confusion attacks, you may need to use the public key as an HMAC secret. Convert the public key to the appropriate format first.

Troubleshooting

Security Considerations

Additional security considerations:

• Be aware that your testing activities may be logged
• Consider the impact of successful privilege escalation
• Document all successful attacks for remediation
• Follow responsible disclosure practices

Related Tools

Combine the JWT Editor with other JWTAuditor tools for comprehensive testing: