Skip to content

Commit

Permalink
docs: update docs with new parameters, bump version number
Browse files Browse the repository at this point in the history
  • Loading branch information
flibustier committed Nov 1, 2023
1 parent 3a9b6b4 commit 875c121
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 7 deletions.
17 changes: 12 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

# jwt-cracker

Simple HS256 JWT token brute force cracker.
Simple HS256, HS384 & HS512 JWT token brute force cracker.

Effective only to crack JWT tokens with weak secrets.
**Recommendation**: Use strong long secrets or RS256 tokens.
Expand All @@ -26,19 +26,19 @@ npm install --global jwt-cracker
From command line:

```bash
jwt-cracker -t <token> [-a <alphabet>] [--max <maxLength>]
jwt-cracker -t <token> [-a <alphabet>] [--max <maxLength>] [-d <dictionaryFilePath>]
```

Where:

* **token**: the full HS256 JWT token string to crack
* **token**: the full HS256-512 JWT token string to crack
* **alphabet**: the alphabet to use for the brute force (default: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
* **maxLength**: the max length of the string generated during the brute force (default: 12)

* **dictionaryFilePath**: path to a list of passwords (one per line) to use instead of brute force

## Requirements

This script requires Node.js version 6.0.0 or higher
This script requires Node.js version 16.0.0 or higher

## Example

Expand All @@ -50,6 +50,13 @@ jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwi

It takes about 2 hours in a Macbook Pro (2.5GHz quad-core Intel Core i7).

Or using a list of passwords taken from https://github.com/danielmiessler/SecLists

```bash
jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -d darkweb2017-top10000.txt
```

It takes less than a second.

## Contributing

Expand Down
8 changes: 6 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "jwt-cracker",
"version": "3.0.0",
"description": "Simple HS256 JWT token brute force cracker",
"version": "4.0.0",
"description": "Simple HS256-512 JWT token brute force cracker",
"main": "index.js",
"type": "module",
"bin": {
Expand Down Expand Up @@ -42,6 +42,10 @@
{
"name": "Rob Waller",
"url": "https://github.com/RobDWaller"
},
{
"name": "Flibustier",
"url": "https://github.com/flibustier"
}
],
"repository": {
Expand Down

0 comments on commit 875c121

Please sign in to comment.