'jwt' 검색 결과

JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Embed Zoom meetings in an Electron desktop app using the Meeting SDK. The skill guides developers through initialization, token-based authentication, joining and starting meetings, settings controls, and integration with raw meeting data.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Embed Zoom meetings in an Electron app
• Design authentication and meeting entry flows
• Organize SDK services, controllers, and events

Expose REST APIs as tools for AI agents through Google Cloud API Gateway using MCP, a protocol for connecting agents to tools. Covers OpenAPI migration, authentication, client connections, validation, and troubleshooting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Expose existing REST APIs as agent tools
• Migrate OpenAPI 2.0 specifications for MCP
• Protect tool listings with JWTs or API keys

Design authentication and access permissions for web apps, mobile apps, and backend services using OAuth 2.0 and OpenID Connect. Get guidance on authorization flows, token validation, secure storage, renewal, and revocation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Add login to a web or mobile app
• Review token storage and renewal
• Design access permissions between services

Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory Android apps included in a security assessment
• Check APKs for embedded credentials and internal API addresses
• Review components that other apps can invoke

Exploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the `alg` header set to `none`, allowing attackers to forge tokens without a valid signature.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when testing JWT-based authentication for algorithm confusion, alg:none bypass, weak HMAC secrets, missing expiration, kid parameter injection, and token storage in localStorage. Trigger on: Authorization: Bearer tokens, JWTs in cookies, any base64url encoded header.payload.signature pattern, OAuth2 access tokens, API authentication tokens, SSO tokens, JWKS endpoints. Detects RS256→HS256 confusion, public key as HMAC secret, unverified kid values used in file reads or SQL queries, and JWT cracking with short secrets.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. bu skill covers implementing secure JWT signing with HMAC-SHA256

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Web uygulamalarında JWT bypass — alg:none, CVE-2022-39227, SSRF zinciri

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Manage Sub2API through its administrator API using a bundled command-line tool. Inspect and update accounts, manage redeem codes, groups, and proxies, import or export accounts, and verify changes with follow-up reads.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing account details and usage before updating settings
• Importing, exporting, or updating multiple accounts
• Generating and redeeming recharge or balance codes

Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review API authentication and access permissions
• Assess GraphQL and WebSocket security
• Check request limits and unintended data exposure

Build custom mobile video experiences in React Native with Zoom Video SDK. Get guidance on setup, joining sessions, routing events into interface state, using helper APIs, and keeping session token generation on the backend.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a custom video interface in a React Native app
• Implement session joining with backend-issued tokens
• Connect session events to interface state

Build transcription workflows for uploaded or stored audio and video using Zoom AI Services Scribe. Consult guidance on authentication, single-file requests, batch jobs, completion notifications, and saving transcript results for further processing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding transcription for uploaded recordings
• Transcribing stored call archives in batches
• Saving transcripts after job completion notifications

Embed Zoom meetings in React Native iOS and Android apps using @zoom/meetingsdk-react-native. Get guidance on setup, authentication, joining and starting meetings, cleanup, and troubleshooting communication between JavaScript and native SDK components.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding Zoom meeting participation to a React Native app
• Implementing host meeting starts with ZAK
• Investigating iOS and Android setup or native bridge issues

Implement and debug Google OAuth 2.0 refresh tokens bound to a client key. Covers key generation, signed DPoP proofs that demonstrate key possession, and nonce challenge retries in WebCrypto and JavaScript environments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Bind Google OAuth refresh tokens to a client key
• Debug DPoP proof signatures and nonce retries
• Plan a backend for a browser application using DPoP

Guides backend development for Node.js, Express, and Next.js API routes. It covers separating application logic from data access, reducing database queries, caching, authentication, error handling, and background jobs through concrete implementation examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separating application logic from database access
• Reducing database queries and adding caching
• Adding authentication, permissions, and request limits

Strix JWT 与 OIDC 安全测试手册,覆盖令牌伪造、算法混淆与声明篡改;触发名:strix-authentication-jwt

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by Keycloak, Auth0, Okta, Cognito, or another authorization server, use oauth2-resource-server.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling. Covers both implementing auth from scratch and integrating auth providers. Use when "implement authentication, oauth login, jwt tokens, session management, social login, password reset, multi-factor auth, refresh tokens, Working with Auth0, Clerk, NextAuth, Passport.js, authentication, oauth, jwt, session, security, login, password, mfa, oidc" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Authentication and authorization expert for OAuth, sessions, JWT, MFA, and identity securityUse when "authentication flow, login system, oauth integration, jwt tokens, session management, password hashing, mfa setup, refresh tokens, social login, role-based access, authentication, authorization, oauth, oidc, jwt, sessions, mfa, passkeys, nextauth, supabase-auth, clerk" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.