jwtear 1.0.1.pre → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79f49f692fd3613b91dfe70d89c5724090d2a1157b6b220a27e355340496f715
-  data.tar.gz: 159a436bb626c60bfe6f6d218a5cd44961e8c470c406f7e1d95f6a07c1682767
+  metadata.gz: 354a9f9e3c1c66b7bc4f3db6671b9e9635a23ee1d2642ef199d186c53bde73df
+  data.tar.gz: 4fb427852cff0bb16156c35eaf1e48fd1f8e4243bee19755fe6cf851986d4987
 SHA512:
-  metadata.gz: 453c4aa04fa178ecde43eee51f00703f793aa3db1a6fb624c621b3e7f603ab9d761c66d719eb0a2af22a1f239104015dd158908188c53eff844828bba44f2057
-  data.tar.gz: 4ff26ab632dfc2e432dce872df5cc846f8bc97b0181ae35c6e8b26593006033f728f2368f97325edbe091c56d97b29c28779b39d0746e0f544f8cd1a70a20238
+  metadata.gz: 3c962fd44c645e70ff38c13c509760b51e6bc0d6a34f15d8d963e54c4ddf6507edf3f7ad077a723319505e293bd5980467385e12762fa7a6bd12ce32e550be7b
+  data.tar.gz: b84d7c42ba7a730d32d2fe097584ad9bee1fb283ef8f343a839bf2d741fa6ab00f92abad0173dfc4034bc955dfa5ce69a5dea262cb15a5b6a34cccc65216fc5c

data/.gitignore

@@ -6,3 +6,5 @@
 /pkg/
 /spec/reports/
 /tmp/
+.idea/
+*.gem

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jwtear (1.0.0)
+    jwtear (1.0.1.pre)
       gli (~> 2.19, >= 2.19.0)
       json-jwt (~> 1.10, >= 1.10.2)
       jwe (~> 0.4.0)

data/README.md

@@ -1,19 +1,22 @@
 # Jwtear
-A modular Command-line tool to parse, create and manipulate JSON Web Token(JWT) tokens for security testing purposes. 
+A modular command-line tool to parse, create and manipulate JSON Web Token(JWT) tokens for security testing purposes. 
 
 ## Features
 - Complete modularity.
     - All commands are plugins.
-    - Easy to add a new plugins.
+    - Easy to add new plugins.
     - Support JWS and JWE tokens.  
 - Easy interface for plugins. (follow the template example)
+- Flexible
+- token generation based on production-class libraries (e.g. json-jwt, jwe).
+
 
 ### Available plugins
 - Parse: parses jwt tokens.
 - jws: manipulate and generate JWS tokens.
 - jwe: manipulate and generate JWE tokens.
 - bruteforce: brutefocing JWS signing key
-- wiki: contains information about JWT, attacks ideas, references.
+- wiki: contains offline information about JWT, attacks ideas, references.
 
 ## Installation
 
@@ -81,7 +84,8 @@ plugins are defined as subcommands. Each subcommand may have one or more argumen
 ```
 $ jwtear parse -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.J8SS8VKlI2yV47C4BtfYukWPx_2welF34Mz7l-MNmkE
 $ jwtear jws -h '{"alg":"HS256","typ":"JWT"}' -p '{"user":"admin"}' -k p@ss0rd123
-$ jwtear bruteforce -t eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjpudWxsfQ.Tr0VvdP6rVBGBGuI_luxGCOaz6BbhC6IxRTlKOW8UjM -l ~/tmp/pass.list -v
+$ jwtear jwe -header '{"enc":"A192GCM","typ":"JWT"}' --payload '{"user":"admin"}' --key public.pem 
+$ jwtear bruteforce -v -t eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjpudWxsfQ.Tr0VvdP6rVBGBGuI_luxGCOaz6BbhC6IxRTlKOW8UjM -l ~/tmp/pass.list
 ```
 
 ## Add plugin
@@ -134,6 +138,19 @@ Once the missing dependencies are installed by the user, the `check_dependencies
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/jwtear.
 
+1. Fork it ( https://github.com/KINGSABRI/jwtear/fork )
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create a new Pull Request
+
+### Areas to contribute
+- contribution by reporting bugs.
+- contribution by perfecting the current code.
+- contribution by adding new plugins.
+- contribution by enhancing the [jwtear wiki](https://github.com/KINGSABRI/jwtear/tree/master/plugins/wiki).
+- contribution by requesting features and/or plugins.
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/bin/jwtear

@@ -17,17 +17,17 @@ module  JWTear
   module CLI
     extend GLI::App
     extend JWTear::Helpers::Utils
-    puts banner
+
     program_desc 'Parse, create and manipulate JWT tokens.'
 
     # CLI settings
-    ENV['GLI_DEBUG'] = "true"  # Uncomment this line for debugging
-    autocomplete_commands true
+    # ENV['GLI_DEBUG'] =      "true"  # Uncomment this line for debugging
+    autocomplete_commands      true
     subcommand_option_handling :normal
-    arguments :strict
-    sort_help :manually
-    wrap_help_text :verbatim #:to_terminal
-    synopsis_format :full #:compact
+    arguments                  :strict
+    sort_help                  :manually
+    wrap_help_text             :verbatim
+    synopsis_format            :full
 
     desc 'Check current and latest version'
     switch [:v, :version],  negatable: false
@@ -40,16 +40,21 @@ module  JWTear
     commands_from dir if Dir.exist? dir
 
     on_error do |exception|
+      puts banner
       case exception
       when GLI::MissingRequiredArgumentsException
         print_error "Option #{exception.message}"
-        exit!
+      when OptionParser::MissingArgument
+        print_error "Option #{exception.message}"
+      when GLI::UnknownCommandArgument
+        print_error "#{exception.message}"
       else
         print_error "Unknown Exception:"
         print_warning 'Please report the issue to: https://github.com/KINGSABRI/jwtear/issues'.underline
         puts exception.full_message
-        exit!
       end
+
+      true
     end
   end
 end

data/lib/jwtear/jwe.rb

@@ -92,6 +92,12 @@ module JWTear
       exit!
     end
 
+    # is_encrypted?
+    #   to check if the given string in a JSON format or its encrypted.
+    #   Used mostly with @encrypted_key as it might come in different format.
+    # @param item [JSON|STRING]
+    #
+    # @return [Boolean]
     def is_encrypted?(item)
       JSON.parse item
       false

data/lib/jwtear/version.rb

@@ -1,3 +1,3 @@
 module JWTear
-  VERSION = "1.0.1.pre"
+  VERSION = "1.0.2"
 end

data/plugins/bruteforce.rb

@@ -16,7 +16,7 @@ module JWTear
       c.desc "Run verbosely."
       c.switch [:v, :verbose], negatable: false
 
-      c.example  %Q{jwtear bruteforce -t TOKEN -l rockyou.list -v}
+      c.example  %Q{jwtear bruteforce -v -t TOKEN -l rockyou.list}
       c.example  %Q{jwtear bruteforce -t TOKEN -l P@ssw0rd123}
 
       c.action do |_, options, _|
@@ -25,7 +25,6 @@ module JWTear
           bf.run(options[:verbose])
         end
       end
-
     end
   end
 
@@ -46,6 +45,7 @@ module JWTear
       case
       when keys.kind_of?(Enumerator::Lazy)
         keys.each do |key|
+          key.valid_encoding? ? key.strip! : next
           print_status "Trying password: #{key}" if verbose
 
           gen_token = @token.generate(:jws, header: @jws.header.to_json, payload:@jws.payload.to_json , key: key)
@@ -56,7 +56,6 @@ module JWTear
             exit!
           else
             print_bad "Invalid key: #{key}" if verbose
-            # puts gen_token if verbose
           end
         end
       when keys.kind_of?(String)
@@ -68,20 +67,14 @@ module JWTear
         else
           print_bad "Invalid key: #{keys}"
         end
-
       else
         print_error "Unknown key type"
         raise
       end
     end
 
-
     def handle_key
-      if File.file?(@list)
-        read_wordlist(@list)
-      else
-        @list
-      end
+      File.file?(@list) ? read_wordlist(@list) : @list
     end
 
     def read_wordlist(file)
@@ -89,7 +82,6 @@ module JWTear
         print_status "Found '#{file}' file."
         File.readlines(file, chomp: true)
             .lazy
-            .map(&:strip)
             .reject(&:empty?)
             .reject(&:nil?)
       else
@@ -97,7 +89,6 @@ module JWTear
         exit!
       end
     end
-
   end
 end
 

data/plugins/wiki/README.md

@@ -164,6 +164,8 @@ This carries the same meaning as explained under JWE compact serialization, prev
 
 This carries the same meaning as explained under JWE compact serialization, previously. The tag element in the JWE token carries the base64url-encoded value of the JWE authenticated tag, which is an outcome of the encryption process using an AEAD algorithm.
 
+_source(JWT, JWS and JWE for Not So Dummies! (Part I))_
+
 ---
 
 
@@ -185,18 +187,18 @@ This carries the same meaning as explained under JWE compact serialization, prev
 ## Vulnerable Applications
 
 * [Damn Vulnerable Web Services - DVWS](https://github.com/snoopysecurity/dvws)
-* [Pentesterlab(Free)| JSON Web Token I](https://pentesterlab.com/exercises/jwt/)
-* [Pentesterlab(PRO) | JSON Web Token II](https://pentesterlab.com/exercises/jwt_ii/)
-* [Pentesterlab(PRO) | JWT III](https://pentesterlab.com/exercises/jwt_iii/)
-* [Pentesterlab(PRO) | JWT IV](https://pentesterlab.com/exercises/jwt_iv)
-* [Pentesterlab(PRO) | JWT V](https://pentesterlab.com/exercises/jwt_v)
-* [Pentesterlab(PRO) | JWT VI](https://pentesterlab.com/exercises/jwt_vi)
-* [Pentesterlab(PRO) | JWT VII](https://pentesterlab.com/exercises/jwt_vii)
-* [Pentesterlab(PRO) | JWT VIII](https://pentesterlab.com/exercises/jwt_viii)
-* [Pentesterlab(PRO) | JWT X](https://pentesterlab.com/exercises/jwt_x/)
-* [Pentesterlab(PRO) | JWT XI](https://pentesterlab.com/exercises/jwt_xi)
-* [Pentesterlab(PRO) | JWT XII](https://pentesterlab.com/exercises/jwt_xii)
-* [Pentesterlab(PRO) | JSON Web Encryption](https://pentesterlab.com/exercises/jwe)
+* [Pentesterlab(Free) - JSON Web Token I](https://pentesterlab.com/exercises/jwt/)
+* [Pentesterlab(PRO)  - JSON Web Token II](https://pentesterlab.com/exercises/jwt_ii/)
+* [Pentesterlab(PRO)  - JWT III](https://pentesterlab.com/exercises/jwt_iii/)
+* [Pentesterlab(PRO)  - JWT IV](https://pentesterlab.com/exercises/jwt_iv)
+* [Pentesterlab(PRO)  - JWT V](https://pentesterlab.com/exercises/jwt_v)
+* [Pentesterlab(PRO)  - JWT VI](https://pentesterlab.com/exercises/jwt_vi)
+* [Pentesterlab(PRO)  - JWT VII](https://pentesterlab.com/exercises/jwt_vii)
+* [Pentesterlab(PRO)  - JWT VIII](https://pentesterlab.com/exercises/jwt_viii)
+* [Pentesterlab(PRO)  - JWT X](https://pentesterlab.com/exercises/jwt_x/)
+* [Pentesterlab(PRO)  - JWT XI](https://pentesterlab.com/exercises/jwt_xi)
+* [Pentesterlab(PRO)  - JWT XII](https://pentesterlab.com/exercises/jwt_xii)
+* [Pentesterlab(PRO)  - JSON Web Encryption](https://pentesterlab.com/exercises/jwe)
 * [Vulnerable JWT implementations](https://github.com/Sjord/jwtdemo)
 
 ## Resources

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwtear
 version: !ruby/object:Gem::Version
-  version: 1.0.1.pre
+  version: 1.0.2
 platform: ruby
 authors:
 - KING SABRI
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-04 00:00:00.000000000 Z
+date: 2019-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gli
@@ -138,9 +138,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.7.6.2