🎫 JSON Web Tokens (JWT)

Format: Header.Payload.Signature

Attacks

Change alg to none.
Change RS256 → HS256 (sign with the public key as HMAC secret):
```
python3 jwt_tool.py <JWT> -S hs256 -k public.pem
```
Crack the signing secret, e.g. c-jwt-cracker.

Inject into the token payload too (see the Jinja2/JWT combo in ssti). References: jwt.io intro · Breaking JWTs.