jwtear 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bd40b5099b880a09ed4277d0964f85d0255a1be9
-  data.tar.gz: 9b016a13f78d711c0b1e4e61de499ed5bdfa30fb
+  metadata.gz: 3f24bff021d010c20bb782b7eff2f8d16f701918
+  data.tar.gz: 172ebf1bd6f14fcfe7612c68fd7943bdee6d4179
 SHA512:
-  metadata.gz: 5d2d82eeabaa80693048981de0f3e3c7ea5688ad3d4b833f9b0893050e04c442adba291a696ac143bfc7f5521b778624e4ed057abba887bbd040a710e2feef35
-  data.tar.gz: 4506e71a5e670fd92c23584e9aa2d2a9cd1e0a5dd235f683b7f60ebd9b3269b705fe6634fff22a9991815237e6a044575b836e26c9c7fb7a703c12c9a9708a5f
+  metadata.gz: 78bdee9155c4b0d508f21d664db28abc623207f960cf96560b4265ad0d676277fc12cc854207222eff8769c04bdc6fa9a163714b4a1e52a99386ff91eb1c994b
+  data.tar.gz: c74e12d75a5172ea39d716be0b237773e4c09c12d35955ac660c30372bfd466b8156c679e882b1db1c9a9f067237c0f44264062a1c5da48dab8cddf96bd1abc7

data/README.md

@@ -12,9 +12,8 @@ install it yourself as:
 ## Usage
 
 ```
-$> jwtear -h 
 
-  888888 888       888 88888888888
+    888888 888       888 88888888888
       "88b 888   o   888     888
        888 888  d8b  888     888
        888 888 d888b 888     888   .d88b.   8888b.  888d888
@@ -22,22 +21,22 @@ $> jwtear -h
        888 88888P Y88888     888  88888888 .d888888 888
        88P 8888P   Y8888     888  Y8b.     888  888 888
        888 888P     Y888     888   "Y8888  "Y888888 888
-     .d88P                                       v0.1.0
+     .d88P                                       v0.1.2
    .d88P"
   888P"    
 JWTear - Parse, create and manipulate JWT tokens.
 
 Help menu:
    -p, --parse JWT_TOKEN            Parse JWT token
-       --generate-token             Generate JWT token.
-       --generate-sig               Generate JWT signature.
-       --header HEADER              JWT header (JSON format). (required for generate-token and generate-sig)
+   -t, --generate-token             Generate JWT token.
+   -s, --generate-sig               Generate JWT signature.
+   -H, --header HEADER              JWT header (JSON format). (required for generate-token and generate-sig)
                                       eg. {"typ":"JWT","alg":"HS256"} | Supported algorithms: [HS256, RS512, etc]
-       --payload PAYLOAD            JWT payload (JSON format). (required for generate-token and generate-sig)
+   -P, --payload PAYLOAD            JWT payload (JSON format). (required for generate-token and generate-sig)
                                       eg. {"login":"admin"}
-       --alg ALGORITHM              Force algorithm type when generating a new token (ignore the one in header). (optional with generate-token)
+   -g, --alg ALGORITHM              Force algorithm type when generating a new token (ignore the one in header). (optional with generate-token)
                                       Supported algorithms: [HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512]
-       --key SECRET                 Secret Key for symmetric encryption. (required for generate-token and generate-sig. Accept password as a string or a file)
+   -k, --key SECRET                 Secret Key for symmetric encryption. (required for generate-token and generate-sig. Accept password as a string or a file)
                                       eg. P@ssw0rd  | eg. public_key.pem
    -h, --help                       Show this help message
 

data/bin/jwtear

@@ -69,7 +69,7 @@ begin
       puts "[+] ".dark_green + "Payload (claim segment):".bold.underline
       jwt.payload.each {|key, value| puts "  #{'-'.bold} #{key}: #{value}"}
       puts "[+] ".dark_green + "Signature (envelope segment) - encoded:".bold.underline
-      puts "#{Base64.urlsafe_encode64(jwt.signature)}"
+      puts encode(jwt.signature) || '---[ no signature ]---'
 
     # checking missing for generate_token
     when options[:generate_token] && (options[:header] || options[:payload] || options[:key]).nil?

data/lib/jwtear/jwt.rb

@@ -36,7 +36,7 @@ module JWTear
       is_token?(token)
       _token = token.split('.')
       @header     = JSON.parse(decode(_token[0]))
-      @type, @alg = @header['type'], @header['alg']
+      @type, @alg = @header['typ'], @header['alg']
       @payload    = JSON.parse(decode(_token[1]))
       @signature  = decode(_token[2]) unless (_token[2].nil? or _token[2].empty?)
       set_hash_and_json
@@ -100,20 +100,29 @@ module JWTear
     # @return [String] the generated token
     #
     def generate_token
+      begin
+        @header   = JSON.parse(@header)  unless @header.is_a?(Hash)
+        @payload  = JSON.parse(@payload) unless @payload.is_a?(Hash)
+        @alg      = @header['alg'] if @alg.nil?   # if algorithm not forced, take if from the header
 
-      @header   = JSON.parse(@header)  unless @header.is_a?(Hash)
-      @payload  = JSON.parse(@payload) unless @payload.is_a?(Hash)
-      @alg      = @header['alg'] if @alg.nil?   # if algorithm not forced, take if from the header
-
-      header_encoded    = encode(@header.to_json)
-      payload_encoded   = encode(@payload.to_json)
-      data              = "#{header_encoded}.#{payload_encoded}"
-      signature_encoded = encode(generate_sig(data, @alg, @key).signature)
-      token     = [header_encoded, payload_encoded, signature_encoded].join('.')
-
-      set_hash_and_json
+        header_encoded    = encode(@header.to_json)
+        payload_encoded   = encode(@payload.to_json)
+        data              = "#{header_encoded}.#{payload_encoded}"
+        signature_encoded = encode(generate_sig(data, @alg, @key).signature)
+        token     = [header_encoded, payload_encoded, signature_encoded].join('.')
 
-      token
+        set_hash_and_json
+        token
+      rescue JSON::ParserError => e
+        puts '[x] '.red + "Invalid JSON: #{e.message}"
+        puts "[!] ".yellow + "Make sure you've single quoted your input: eg. --header #{"'".bold}{\"type\":\"JWT\",\"alg\":\"HS256\"}#{"'".bold}"
+        exit!
+      rescue Exception => e
+        puts "[x] ".red + "Unknown Exception: generate_sig"
+        puts '[!] '.yellow + 'Please report the issue at: https://github.com/KINGSABRI/jwtear/issues'.underline
+        puts e
+        puts e.backtrace
+      end
     end
 
   end

data/lib/jwtear/utils.rb

@@ -13,7 +13,7 @@ module JWTear
     end
     
     def encode(data)
-      Base64.urlsafe_encode64(data, padding: false)
+      Base64.urlsafe_encode64(data, padding: false) unless data.nil?
     end
 
     def decode(data)

data/lib/jwtear/version.rb

@@ -1,3 +1,3 @@
 module JWTear
-  VERSION = "0.1.2"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwtear
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - KING SABRI
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-19 00:00:00.000000000 Z
+date: 2018-01-27 00:00:00.000000000 Z
 dependencies: []
 description: JWTear, command-line tool and library to parse, create and manipulate
   JWT tokens for security testing purposes.