vamp-jwt-audit 1.0.1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. vamp_jwt_audit-1.0.1/LICENSE +21 -0
  2. vamp_jwt_audit-1.0.1/PKG-INFO +177 -0
  3. vamp_jwt_audit-1.0.1/README.md +152 -0
  4. vamp_jwt_audit-1.0.1/pyproject.toml +37 -0
  5. vamp_jwt_audit-1.0.1/setup.cfg +4 -0
  6. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/PKG-INFO +177 -0
  7. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/SOURCES.txt +11 -0
  8. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/dependency_links.txt +1 -0
  9. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/entry_points.txt +2 -0
  10. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/requires.txt +4 -0
  11. vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/top_level.txt +2 -0
  12. vamp_jwt_audit-1.0.1/vamp_jwt_audit.py +1075 -0
  13. vamp_jwt_audit-1.0.1/vampsec_report.py +959 -0
vamp_jwt_audit-1.0.1/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 VampSecure Studios
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
vamp_jwt_audit-1.0.1/PKG-INFO ADDED
@@ -0,0 +1,177 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-jwt-audit
3
+ Version: 1.0.1
4
+ Summary: JWT security auditor — alg=none, RS256-to-HS256 confusion, HMAC brute force
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-jwt-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-jwt-audit
9
+ Keywords: jwt,json-web-token,security,audit,pentest,web-security,authentication
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Classifier: Topic :: Internet :: WWW/HTTP
18
+ Requires-Python: >=3.8
19
+ Description-Content-Type: text/markdown
20
+ License-File: LICENSE
21
+ Requires-Dist: rich>=13.7.0
22
+ Provides-Extra: rs256
23
+ Requires-Dist: cryptography>=41.0; extra == "rs256"
24
+ Dynamic: license-file
25
+
26
+ <h1 align="center">vamp-jwt-audit</h1>
27
+
28
+ <p align="center">
29
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
30
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
31
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
32
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
33
+ </p>
34
+
35
+ ## Overview
36
+
37
+ `vamp-jwt-audit` is a JWT (JSON Web Token) security auditor that tests tokens for the full range of documented attack classes: `alg=none` bypass, RS256-to-HS256 algorithm confusion, HMAC brute-force against a 200+ entry built-in wordlist, header injection attacks (`jku`, `x5u`, `jwk`, `kid`), and claims-level security issues. It accepts tokens from the command line, a file, or standard input — making it easy to slot into proxies, CI pipelines, or capture-the-flag workflows. The optional `cryptography` library unlocks the RS256-to-HS256 attack when a public key is supplied.
38
+
39
+ ## Features
40
+
41
+ - Six-phase attack sequence: decode without verification, header analysis, claims analysis, craft `alg=none` token, HMAC brute-force, RS256→HS256 confusion
42
+ - Built-in wordlist with 200+ common secrets including framework defaults, Docker/Kubernetes defaults, and the empty string
43
+ - Header injection checks: `alg=none` (CRITICAL), `jku`/`x5u` key URL injection (CRITICAL), inline `jwk` (CRITICAL), `kid` path traversal and SQL injection patterns (CRITICAL)
44
+ - Claims security checks: missing `exp` (HIGH), expired token (MEDIUM), TTL > 24 hours (LOW), `nbf` in future (MEDIUM), missing `iss`/`aud` (LOW), privileged role claims (HIGH), PII in payload (MEDIUM)
45
+ - RS256→HS256 confusion attack: forges a valid-looking HS256 token signed with the RSA public key (requires `--pubkey` and `cryptography`)
46
+ - Custom wordlist support (`--wordlist`) with automatic fallback to the built-in list
47
+ - Supports single token (`--token`), file of tokens (`--file`), and stdin pipeline mode (`--stdin`)
48
+ - Export to Console (Rich panels), JSON, and HTML (dark-theme)
49
+
50
+ ## Requirements
51
+
52
+ - Python 3.9 or later
53
+ - `rich >= 13.7.0`
54
+ - Optional: `cryptography >= 41.0` — required for `--pubkey` (RS256→HS256 confusion attack)
55
+
56
+ ## Installation
57
+
58
+ ```bash
59
+ git clone https://github.com/belky-me/vamp-jwt-audit.git
60
+ cd vamp-jwt-audit
61
+ python3 -m venv .venv
62
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
63
+ pip install -r requirements.txt
64
+ # For RS256→HS256 attack support:
65
+ pip install cryptography
66
+ ```
67
+
68
+ ## Usage
69
+
70
+ ```
71
+ python3 vamp_jwt_audit.py --help
72
+ ```
73
+
74
+ ```
75
+ usage: vamp_jwt_audit.py [-h]
76
+ Token source (mutually exclusive):
77
+ --token JWT, -t JWT
78
+ --file FILE, -f FILE
79
+ --stdin
80
+
81
+ Attack options:
82
+ --wordlist FILE, -w FILE
83
+ --pubkey FILE
84
+ --no-bruteforce
85
+
86
+ Output:
87
+ --json FILE
88
+ --html FILE
89
+ --quiet
90
+ --client CLIENT --engagement ENGAGEMENT --auditor AUDITOR
91
+ --report-scope SCOPE --report-html FILE --report-pdf FILE
92
+
93
+ vamp-jwt-audit — JWT Security Auditor (VampSecure Labs)
94
+ ```
95
+
96
+ ## Examples
97
+
98
+ ```bash
99
+ # Audit a single token passed directly
100
+ python3 vamp_jwt_audit.py --token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
101
+
102
+ # Read token from file
103
+ python3 vamp_jwt_audit.py --file captured_token.txt
104
+
105
+ # Pipe a token from another tool
106
+ cat token.txt | python3 vamp_jwt_audit.py --stdin
107
+
108
+ # Use a custom wordlist for HMAC brute-force
109
+ python3 vamp_jwt_audit.py --token <JWT> --wordlist /path/to/secrets.txt
110
+
111
+ # Run RS256→HS256 confusion attack using a captured public key
112
+ python3 vamp_jwt_audit.py --token <JWT> --pubkey server_pubkey.pem
113
+
114
+ # Skip brute-force (faster static analysis only)
115
+ python3 vamp_jwt_audit.py --token <JWT> --no-bruteforce
116
+
117
+ # Export findings to JSON and HTML
118
+ python3 vamp_jwt_audit.py --token <JWT> --json results.json --html report.html
119
+
120
+ # Generate client-ready engagement report
121
+ python3 vamp_jwt_audit.py --file tokens.txt \
122
+ --client "Acme Corp" --engagement "JWT Implementation Review Q3 2026" \
123
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
124
+ ```
125
+
126
+ ## CLI Reference
127
+
128
+ | Flag | Default | Description |
129
+ |------|---------|-------------|
130
+ | `--token / -t JWT` | — | JWT token string (mutually exclusive with `--file`/`--stdin`) |
131
+ | `--file / -f FILE` | — | File containing one or more JWT tokens |
132
+ | `--stdin` | — | Read token from standard input |
133
+ | `--wordlist / -w FILE` | built-in (200+) | Custom wordlist for HMAC brute-force |
134
+ | `--pubkey FILE` | — | RSA/EC public key PEM file for RS256→HS256 confusion |
135
+ | `--no-bruteforce` | off | Skip HMAC brute-force phase |
136
+ | `--json FILE` | — | Export results to JSON |
137
+ | `--html FILE` | — | Export dark-theme HTML report |
138
+ | `--quiet` | off | Suppress banner |
139
+ | `--client TEXT` | — | Client name for VSL engagement report |
140
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
141
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
142
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
143
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
144
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
145
+
146
+ ## Output Formats
147
+
148
+ | Format | Flag | Description |
149
+ |--------|------|-------------|
150
+ | Console | (default) | Rich panels with decoded header/payload, attack results, and severity ratings |
151
+ | JSON | `--json FILE` | Machine-readable full result set including forged token strings |
152
+ | HTML | `--html FILE` | Dark-theme standalone report |
153
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
154
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
155
+
156
+ ## Exit Codes
157
+
158
+ | Code | Meaning | CI/CD Behavior |
159
+ |------|---------|----------------|
160
+ | `0` | No critical or high findings | Pipeline passes |
161
+ | `1` | High-severity findings detected | Pipeline fails — review required |
162
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
163
+
164
+ ## Legal Notice
165
+
166
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
167
+
168
+ ## Part of VampSecure Labs Toolkit
169
+
170
+ `vamp-jwt-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
171
+
172
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
173
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
174
+
175
+ ---
176
+
177
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_jwt_audit-1.0.1/README.md ADDED
@@ -0,0 +1,152 @@
1
+ <h1 align="center">vamp-jwt-audit</h1>
2
+
3
+ <p align="center">
4
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
5
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
6
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
7
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
8
+ </p>
9
+
10
+ ## Overview
11
+
12
+ `vamp-jwt-audit` is a JWT (JSON Web Token) security auditor that tests tokens for the full range of documented attack classes: `alg=none` bypass, RS256-to-HS256 algorithm confusion, HMAC brute-force against a 200+ entry built-in wordlist, header injection attacks (`jku`, `x5u`, `jwk`, `kid`), and claims-level security issues. It accepts tokens from the command line, a file, or standard input — making it easy to slot into proxies, CI pipelines, or capture-the-flag workflows. The optional `cryptography` library unlocks the RS256-to-HS256 attack when a public key is supplied.
13
+
14
+ ## Features
15
+
16
+ - Six-phase attack sequence: decode without verification, header analysis, claims analysis, craft `alg=none` token, HMAC brute-force, RS256→HS256 confusion
17
+ - Built-in wordlist with 200+ common secrets including framework defaults, Docker/Kubernetes defaults, and the empty string
18
+ - Header injection checks: `alg=none` (CRITICAL), `jku`/`x5u` key URL injection (CRITICAL), inline `jwk` (CRITICAL), `kid` path traversal and SQL injection patterns (CRITICAL)
19
+ - Claims security checks: missing `exp` (HIGH), expired token (MEDIUM), TTL > 24 hours (LOW), `nbf` in future (MEDIUM), missing `iss`/`aud` (LOW), privileged role claims (HIGH), PII in payload (MEDIUM)
20
+ - RS256→HS256 confusion attack: forges a valid-looking HS256 token signed with the RSA public key (requires `--pubkey` and `cryptography`)
21
+ - Custom wordlist support (`--wordlist`) with automatic fallback to the built-in list
22
+ - Supports single token (`--token`), file of tokens (`--file`), and stdin pipeline mode (`--stdin`)
23
+ - Export to Console (Rich panels), JSON, and HTML (dark-theme)
24
+
25
+ ## Requirements
26
+
27
+ - Python 3.9 or later
28
+ - `rich >= 13.7.0`
29
+ - Optional: `cryptography >= 41.0` — required for `--pubkey` (RS256→HS256 confusion attack)
30
+
31
+ ## Installation
32
+
33
+ ```bash
34
+ git clone https://github.com/belky-me/vamp-jwt-audit.git
35
+ cd vamp-jwt-audit
36
+ python3 -m venv .venv
37
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
38
+ pip install -r requirements.txt
39
+ # For RS256→HS256 attack support:
40
+ pip install cryptography
41
+ ```
42
+
43
+ ## Usage
44
+
45
+ ```
46
+ python3 vamp_jwt_audit.py --help
47
+ ```
48
+
49
+ ```
50
+ usage: vamp_jwt_audit.py [-h]
51
+ Token source (mutually exclusive):
52
+ --token JWT, -t JWT
53
+ --file FILE, -f FILE
54
+ --stdin
55
+
56
+ Attack options:
57
+ --wordlist FILE, -w FILE
58
+ --pubkey FILE
59
+ --no-bruteforce
60
+
61
+ Output:
62
+ --json FILE
63
+ --html FILE
64
+ --quiet
65
+ --client CLIENT --engagement ENGAGEMENT --auditor AUDITOR
66
+ --report-scope SCOPE --report-html FILE --report-pdf FILE
67
+
68
+ vamp-jwt-audit — JWT Security Auditor (VampSecure Labs)
69
+ ```
70
+
71
+ ## Examples
72
+
73
+ ```bash
74
+ # Audit a single token passed directly
75
+ python3 vamp_jwt_audit.py --token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
76
+
77
+ # Read token from file
78
+ python3 vamp_jwt_audit.py --file captured_token.txt
79
+
80
+ # Pipe a token from another tool
81
+ cat token.txt | python3 vamp_jwt_audit.py --stdin
82
+
83
+ # Use a custom wordlist for HMAC brute-force
84
+ python3 vamp_jwt_audit.py --token <JWT> --wordlist /path/to/secrets.txt
85
+
86
+ # Run RS256→HS256 confusion attack using a captured public key
87
+ python3 vamp_jwt_audit.py --token <JWT> --pubkey server_pubkey.pem
88
+
89
+ # Skip brute-force (faster static analysis only)
90
+ python3 vamp_jwt_audit.py --token <JWT> --no-bruteforce
91
+
92
+ # Export findings to JSON and HTML
93
+ python3 vamp_jwt_audit.py --token <JWT> --json results.json --html report.html
94
+
95
+ # Generate client-ready engagement report
96
+ python3 vamp_jwt_audit.py --file tokens.txt \
97
+ --client "Acme Corp" --engagement "JWT Implementation Review Q3 2026" \
98
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
99
+ ```
100
+
101
+ ## CLI Reference
102
+
103
+ | Flag | Default | Description |
104
+ |------|---------|-------------|
105
+ | `--token / -t JWT` | — | JWT token string (mutually exclusive with `--file`/`--stdin`) |
106
+ | `--file / -f FILE` | — | File containing one or more JWT tokens |
107
+ | `--stdin` | — | Read token from standard input |
108
+ | `--wordlist / -w FILE` | built-in (200+) | Custom wordlist for HMAC brute-force |
109
+ | `--pubkey FILE` | — | RSA/EC public key PEM file for RS256→HS256 confusion |
110
+ | `--no-bruteforce` | off | Skip HMAC brute-force phase |
111
+ | `--json FILE` | — | Export results to JSON |
112
+ | `--html FILE` | — | Export dark-theme HTML report |
113
+ | `--quiet` | off | Suppress banner |
114
+ | `--client TEXT` | — | Client name for VSL engagement report |
115
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
116
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
117
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
118
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
119
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
120
+
121
+ ## Output Formats
122
+
123
+ | Format | Flag | Description |
124
+ |--------|------|-------------|
125
+ | Console | (default) | Rich panels with decoded header/payload, attack results, and severity ratings |
126
+ | JSON | `--json FILE` | Machine-readable full result set including forged token strings |
127
+ | HTML | `--html FILE` | Dark-theme standalone report |
128
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
129
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
130
+
131
+ ## Exit Codes
132
+
133
+ | Code | Meaning | CI/CD Behavior |
134
+ |------|---------|----------------|
135
+ | `0` | No critical or high findings | Pipeline passes |
136
+ | `1` | High-severity findings detected | Pipeline fails — review required |
137
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
138
+
139
+ ## Legal Notice
140
+
141
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
142
+
143
+ ## Part of VampSecure Labs Toolkit
144
+
145
+ `vamp-jwt-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
146
+
147
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
148
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
149
+
150
+ ---
151
+
152
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_jwt_audit-1.0.1/pyproject.toml ADDED
@@ -0,0 +1,37 @@
1
+ [build-system]
2
+ requires = ["setuptools>=68", "wheel"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "vamp-jwt-audit"
7
+ version = "1.0.1"
8
+ description = "JWT security auditor — alg=none, RS256-to-HS256 confusion, HMAC brute force"
9
+ readme = "README.md"
10
+ license = { text = "MIT" }
11
+ requires-python = ">=3.8"
12
+ authors = [{ name = "VampSecure Studios", email = "contact@vampsecurestudios.com" }]
13
+ keywords = ["jwt", "json-web-token", "security", "audit", "pentest", "web-security", "authentication"]
14
+ classifiers = [
15
+ "Development Status :: 5 - Production/Stable",
16
+ "Environment :: Console",
17
+ "Intended Audience :: Information Technology",
18
+ "License :: OSI Approved :: MIT License",
19
+ "Operating System :: OS Independent",
20
+ "Programming Language :: Python :: 3",
21
+ "Topic :: Security",
22
+ "Topic :: Internet :: WWW/HTTP",
23
+ ]
24
+ dependencies = ["rich>=13.7.0"]
25
+
26
+ [project.optional-dependencies]
27
+ rs256 = ["cryptography>=41.0"]
28
+
29
+ [project.scripts]
30
+ vamp-jwt-audit = "vamp_jwt_audit:main"
31
+
32
+ [project.urls]
33
+ Homepage = "https://github.com/Vampsecure-Labs/vamp-jwt-audit"
34
+ Repository = "https://github.com/Vampsecure-Labs/vamp-jwt-audit"
35
+
36
+ [tool.setuptools]
37
+ py-modules = ["vamp_jwt_audit", "vampsec_report"]
vamp_jwt_audit-1.0.1/setup.cfg ADDED
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+
vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/PKG-INFO ADDED
@@ -0,0 +1,177 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-jwt-audit
3
+ Version: 1.0.1
4
+ Summary: JWT security auditor — alg=none, RS256-to-HS256 confusion, HMAC brute force
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-jwt-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-jwt-audit
9
+ Keywords: jwt,json-web-token,security,audit,pentest,web-security,authentication
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Classifier: Topic :: Internet :: WWW/HTTP
18
+ Requires-Python: >=3.8
19
+ Description-Content-Type: text/markdown
20
+ License-File: LICENSE
21
+ Requires-Dist: rich>=13.7.0
22
+ Provides-Extra: rs256
23
+ Requires-Dist: cryptography>=41.0; extra == "rs256"
24
+ Dynamic: license-file
25
+
26
+ <h1 align="center">vamp-jwt-audit</h1>
27
+
28
+ <p align="center">
29
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
30
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
31
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
32
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
33
+ </p>
34
+
35
+ ## Overview
36
+
37
+ `vamp-jwt-audit` is a JWT (JSON Web Token) security auditor that tests tokens for the full range of documented attack classes: `alg=none` bypass, RS256-to-HS256 algorithm confusion, HMAC brute-force against a 200+ entry built-in wordlist, header injection attacks (`jku`, `x5u`, `jwk`, `kid`), and claims-level security issues. It accepts tokens from the command line, a file, or standard input — making it easy to slot into proxies, CI pipelines, or capture-the-flag workflows. The optional `cryptography` library unlocks the RS256-to-HS256 attack when a public key is supplied.
38
+
39
+ ## Features
40
+
41
+ - Six-phase attack sequence: decode without verification, header analysis, claims analysis, craft `alg=none` token, HMAC brute-force, RS256→HS256 confusion
42
+ - Built-in wordlist with 200+ common secrets including framework defaults, Docker/Kubernetes defaults, and the empty string
43
+ - Header injection checks: `alg=none` (CRITICAL), `jku`/`x5u` key URL injection (CRITICAL), inline `jwk` (CRITICAL), `kid` path traversal and SQL injection patterns (CRITICAL)
44
+ - Claims security checks: missing `exp` (HIGH), expired token (MEDIUM), TTL > 24 hours (LOW), `nbf` in future (MEDIUM), missing `iss`/`aud` (LOW), privileged role claims (HIGH), PII in payload (MEDIUM)
45
+ - RS256→HS256 confusion attack: forges a valid-looking HS256 token signed with the RSA public key (requires `--pubkey` and `cryptography`)
46
+ - Custom wordlist support (`--wordlist`) with automatic fallback to the built-in list
47
+ - Supports single token (`--token`), file of tokens (`--file`), and stdin pipeline mode (`--stdin`)
48
+ - Export to Console (Rich panels), JSON, and HTML (dark-theme)
49
+
50
+ ## Requirements
51
+
52
+ - Python 3.9 or later
53
+ - `rich >= 13.7.0`
54
+ - Optional: `cryptography >= 41.0` — required for `--pubkey` (RS256→HS256 confusion attack)
55
+
56
+ ## Installation
57
+
58
+ ```bash
59
+ git clone https://github.com/belky-me/vamp-jwt-audit.git
60
+ cd vamp-jwt-audit
61
+ python3 -m venv .venv
62
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
63
+ pip install -r requirements.txt
64
+ # For RS256→HS256 attack support:
65
+ pip install cryptography
66
+ ```
67
+
68
+ ## Usage
69
+
70
+ ```
71
+ python3 vamp_jwt_audit.py --help
72
+ ```
73
+
74
+ ```
75
+ usage: vamp_jwt_audit.py [-h]
76
+ Token source (mutually exclusive):
77
+ --token JWT, -t JWT
78
+ --file FILE, -f FILE
79
+ --stdin
80
+
81
+ Attack options:
82
+ --wordlist FILE, -w FILE
83
+ --pubkey FILE
84
+ --no-bruteforce
85
+
86
+ Output:
87
+ --json FILE
88
+ --html FILE
89
+ --quiet
90
+ --client CLIENT --engagement ENGAGEMENT --auditor AUDITOR
91
+ --report-scope SCOPE --report-html FILE --report-pdf FILE
92
+
93
+ vamp-jwt-audit — JWT Security Auditor (VampSecure Labs)
94
+ ```
95
+
96
+ ## Examples
97
+
98
+ ```bash
99
+ # Audit a single token passed directly
100
+ python3 vamp_jwt_audit.py --token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
101
+
102
+ # Read token from file
103
+ python3 vamp_jwt_audit.py --file captured_token.txt
104
+
105
+ # Pipe a token from another tool
106
+ cat token.txt | python3 vamp_jwt_audit.py --stdin
107
+
108
+ # Use a custom wordlist for HMAC brute-force
109
+ python3 vamp_jwt_audit.py --token <JWT> --wordlist /path/to/secrets.txt
110
+
111
+ # Run RS256→HS256 confusion attack using a captured public key
112
+ python3 vamp_jwt_audit.py --token <JWT> --pubkey server_pubkey.pem
113
+
114
+ # Skip brute-force (faster static analysis only)
115
+ python3 vamp_jwt_audit.py --token <JWT> --no-bruteforce
116
+
117
+ # Export findings to JSON and HTML
118
+ python3 vamp_jwt_audit.py --token <JWT> --json results.json --html report.html
119
+
120
+ # Generate client-ready engagement report
121
+ python3 vamp_jwt_audit.py --file tokens.txt \
122
+ --client "Acme Corp" --engagement "JWT Implementation Review Q3 2026" \
123
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
124
+ ```
125
+
126
+ ## CLI Reference
127
+
128
+ | Flag | Default | Description |
129
+ |------|---------|-------------|
130
+ | `--token / -t JWT` | — | JWT token string (mutually exclusive with `--file`/`--stdin`) |
131
+ | `--file / -f FILE` | — | File containing one or more JWT tokens |
132
+ | `--stdin` | — | Read token from standard input |
133
+ | `--wordlist / -w FILE` | built-in (200+) | Custom wordlist for HMAC brute-force |
134
+ | `--pubkey FILE` | — | RSA/EC public key PEM file for RS256→HS256 confusion |
135
+ | `--no-bruteforce` | off | Skip HMAC brute-force phase |
136
+ | `--json FILE` | — | Export results to JSON |
137
+ | `--html FILE` | — | Export dark-theme HTML report |
138
+ | `--quiet` | off | Suppress banner |
139
+ | `--client TEXT` | — | Client name for VSL engagement report |
140
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
141
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
142
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
143
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
144
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
145
+
146
+ ## Output Formats
147
+
148
+ | Format | Flag | Description |
149
+ |--------|------|-------------|
150
+ | Console | (default) | Rich panels with decoded header/payload, attack results, and severity ratings |
151
+ | JSON | `--json FILE` | Machine-readable full result set including forged token strings |
152
+ | HTML | `--html FILE` | Dark-theme standalone report |
153
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
154
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
155
+
156
+ ## Exit Codes
157
+
158
+ | Code | Meaning | CI/CD Behavior |
159
+ |------|---------|----------------|
160
+ | `0` | No critical or high findings | Pipeline passes |
161
+ | `1` | High-severity findings detected | Pipeline fails — review required |
162
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
163
+
164
+ ## Legal Notice
165
+
166
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
167
+
168
+ ## Part of VampSecure Labs Toolkit
169
+
170
+ `vamp-jwt-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
171
+
172
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
173
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
174
+
175
+ ---
176
+
177
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/SOURCES.txt ADDED
@@ -0,0 +1,11 @@
1
+ LICENSE
2
+ README.md
3
+ pyproject.toml
4
+ vamp_jwt_audit.py
5
+ vampsec_report.py
6
+ vamp_jwt_audit.egg-info/PKG-INFO
7
+ vamp_jwt_audit.egg-info/SOURCES.txt
8
+ vamp_jwt_audit.egg-info/dependency_links.txt
9
+ vamp_jwt_audit.egg-info/entry_points.txt
10
+ vamp_jwt_audit.egg-info/requires.txt
11
+ vamp_jwt_audit.egg-info/top_level.txt
vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/entry_points.txt ADDED
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ vamp-jwt-audit = vamp_jwt_audit:main
vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/requires.txt ADDED
@@ -0,0 +1,4 @@
1
+ rich>=13.7.0
2
+
3
+ [rs256]
4
+ cryptography>=41.0
vamp_jwt_audit-1.0.1/vamp_jwt_audit.egg-info/top_level.txt ADDED
@@ -0,0 +1,2 @@
1
+ vamp_jwt_audit
2
+ vampsec_report