> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/jwt.md).
# JWT 攻击
JWT 身份验证绕过、算法混淆、弱密钥、JWK 注入、JKU 注入、kid 路径遍历以及签名验证缺陷。
用于 PortSwigger Web Security Academy 实验的 JWT 攻击笔记，重点关注实际测试步骤、Burp Suite 验证、有效载荷行为以及利用流程。
## 测试流程
1. 识别存在漏洞的功能，以及相关的请求、参数、请求头、Cookie 或浏览器端 sink。
2. 在进一步发起攻击之前，先在 Burp Suite 中使用最小有效载荷复现该行为。
3. 使用清晰的概念验证来验证影响，例如账户访问、数据泄露、代码执行、SSRF 或状态变更。
4. 在记录利用路径时，保持有效载荷、URL、令牌和实验室凭据不变。
## 实验
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/jwt.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.