distributed-jwt-cracker

distributed-jwt-cracker

An experimental distributed JWT token cracker built using Node.js and ZeroMQ. It can be used to discover the password (or "secret") of an unencrypted JWT token using a HS256 signature.

Install

Through NPM:

npm i -g distributed-jwt-cracker

Requires ZeroMq libraries to be already installed in your machine.

Usage

Server

To start a new server:

jwt-cracker-server <jwtToken> [options]

The following options are available:

option	description	type	default
-p, --port	The port used to accept incoming connections	number	9900
-P, --pubPort	The port used to publish signals to all the workers	number	9901
-a, --alphabet	The alphabet used to generate the passwords	string	"abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789"
-b, --batchSize	The number of attempts assigned to every client in a batch	number	1000000
-s, --start	The index from where to start the search	number	0

Example, using the example JWT.io token over a simple alphabet:

jwt-cracker-server eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -a=abcdefghijklmnopqrstuwxyz

Client

To start a new client:

jwt-cracker-client [options]

The following options are available:

option	description	type	default
-h, --host	The hostname of the server	string	"localhost"
-p, --port	The port used to connect to the batch server	number	9900
-P, --pubPort	The port used to subscribe to broadcast signals (e.g. exit)	number	9901

Example:

jwt-cracker-client --host=localhost --port=9900 --pubPort=9901

The making of

This project has been thoroughly discussed in two articles published on RisingStack community blog:

• ZeroMQ & Node.js Tutorial - Cracking JWT Tokens (Part 1.)
• ZeroMQ & Node.js Tutorial - Cracking JWT Tokens (Part 2.)

Contributing

Everyone is very welcome to contribute to this project. You can contribute just by submitting bugs or suggesting improvements by opening an issue on GitHub.

License

Licensed under MIT License. © Luciano Mammino.