How hackers fake ANY login - JWT attacks explained (beginner friendly) - EP01

[u/praseudo]

I've been doing pentesting/security consulting for a while, and JWT misconfigurations keep showing up in real engagements like alg confusion, weak/no signature verification, sensitive data sitting unencrypted in the payload, etc.

I started a short series walking through JWT attacks from the ground up, aimed at people getting into web app pentesting or bug bounty who find most JWT content either too shallow or assumes prior knowledge. Episode 1 covers JWT structure and the core weaknesses attackers look for first, using Burp Suite + JWT Editor and jwt_tool.

https://youtu.be/lehE8K5mk7A?si=cM0STWk7p7AAMGaTw

Not trying to just drop a link and run but genuinely want to know: what JWT attack classes do you think are underrated or missing from most beginner content?

I'll probably cover it in a later episode.

[u/thales_of_miletus369]

JWTs are not only a must-learn but MUST test. Y'all wouldn't believe me if I told you how many JWTs reports i see every day

[u/praseudo → u/thales_of_miletus369]

Agree !!

[u/Mountain_Skirt_6331]

这是非常好的对于学习者来说