A hands-on playground for learning JWT vulnerabilities.
Break things. Understand why. Do better.

---

What's this?

Real exploits on real - broken - authentication code.

Each lab is a self-contained Docker app that teaches one JWT attack vector end-to-end: read the vuln, run the exploit, get the flag.

---

Labs

Name	Vulnerability	Difficulty
Blind Trust	Unverified JWT Signature	🟢 Easy
Voiding The Rules	alg: none Bypass	🟢 Easy
Secrets Under The Rug	Weak HMAC Secret	🟡 Medium
Chameleon Hashes	RS256 -> HS256 Confusion	🟠 Hard
Wrong Turn	kid Header Path Traversal	🟠 Hard
Trojan Keys	JWK Header Injection	🔴 Expert
Puppet Master	JKU Header Injection	🔴 Expert
Shadow Key	Algorithm Confusion + Public Key Recovery	🔴 Expert

---

Quick Start

cd <lab-folder>
docker build -t <lab-name> .
docker run -p 3000:3000 <lab-name>
# open http://localhost:3000

Each lab's README has specific instructions, hints, and a full solution walkthrough.

---

Prerequisites

• Docker
• A browser
• Some curiosity

---

Learning Path

Work through the labs in order - each one builds on the previous:

1. Blind Trust - JWT signatures are never verified; modify any claim you like
2. Voiding The Rules - Set alg to none and strip the signature entirely
3. Secrets Under The Rug - Crack a weak HMAC secret offline, forge an admin token
4. Chameleon Hashes - Confuse an RS256 server into accepting HS256 signed with the public key
5. Wrong Turn - Traverse the filesystem via kid, sign with an empty key
6. Trojan Keys - Embed your own public key in the token header, bypass the keystore
7. Puppet Master - Point jku at your own JWKS server, sign with your own key
8. Shadow Key - Recover the hidden RSA public key from two signatures (sig2n), then forge

---

Contributing

PRs welcome. See CONTRIBUTORS.md for guidelines.