Automated JWT vulnerability assessment with algorithm confusion detection, JKU/X5U SSRF injection, DOM XSS analysis via Playwright, and AI-powered verdict generation. Purpose-built for application security teams.
One platform. Every JWT vulnerability class your penetration testing team needs: algorithm confusion, DOM XSS, SSRF injection, BOLA, and AI verdict generation.
Detects RS256→HS256 downgrade vulnerabilities by signing tokens with the public key as an HMAC secret. Also tests none-algorithm bypass and weak HMAC secret brute-force. Every test logged with full request/response evidence.
Forges JWT headers with attacker-controlled JKU and X5U URLs pointing to a live callback server. When the target fetches the attacker JWKS endpoint, the callback is recorded as network-level proof of SSRF exploitability.
Tests expired JWT acceptance, modified payload without re-signing, none-algorithm bypass, and tampered header parameters. Systematically proves whether the target enforces cryptographic integrity checks.
Broken Object Level Authorization testing sends requests with JWT claims modified to reference other users' or resources' IDs. Checks whether the target enforces authorization at the object level or trusts token claims blindly.
Server-side Playwright renders target pages with JWT-derived payloads injected into localStorage, sessionStorage, cookies, and URL parameters. Detects 11 DOM XSS sink patterns including innerHTML, document.write, eval, and location.href.
Authenticated and unauthenticated endpoint discovery with JWT token propagation. Follows links, extracts API paths, maps the attack surface, and feeds discovered endpoints directly into the JWT assessment pipeline.
Connects to LM Studio running on your machine via the MCP protocol. The AI model analyses JWT attack results (token structures, response codes, callback logs) and generates structured verdicts with CVE references and remediation guidance.
Per-session attacker callback server with live JWKS endpoint hosting. Every inbound request from the target during JKU/X5U tests is captured, timestamped, and surfaced in the UI with full HTTP details as audit evidence.
Invite-only workspace isolation with role-based access control: Viewer, Analyst, OrgAdmin, and SuperAdmin. OTP-verified email authentication. Full assessment history and attack registry scoped per organisation.
Dockerized microservices with a live attacker callback server, Playwright headless engine, and local AI integration via MCP. No data leaves your environment.
Every test produces structured evidence, not just a pass/fail flag. Built for pentesters who need defensible findings in client reports.
Algorithm confusion testing covers RS256→HS256 downgrade, none-algorithm bypass, and weak HMAC secret brute-force. Every test is logged with request/response evidence and a verdict from the AI engine.
JKU and X5U headers are injected with attacker-controlled URLs. The platform hosts a live JWKS endpoint and logs every callback the target server makes as network-level proof of SSRF exploitability.
Playwright renders target pages with JWT-derived payloads injected into localStorage, sessionStorage, cookies, and URL parameters. Detects 11 DOM sink patterns including innerHTML, eval, document.write, and location.href.
LM Studio analyses test results via the MCP protocol and generates structured verdicts with CVE references, CVSS scores, and remediation guidance. Your LLM data stays entirely on-premises.
Every attack vector, every feature available to all users at no cost. Sign up and run your first assessment in minutes. No credit card. No invite required.
"The algorithm confusion detection is the first tool we've found that actually proves RS256→HS256 exploitability with a real signed token. No more manual crafting. The evidence is right there in the UI."
"JKU SSRF testing with an embedded attacker server is exactly what penetration testing reports need: live callback logs as evidence, not just theory. Our clients finally see network-level proof."
"DOM XSS via Playwright was a revelation. Found three XSS sinks in our JWT-heavy frontend that our SAST tools had completely missed. The AI verdict had a CVE reference and a ready-to-use remediation."
Free for everyone. Create your account and run your first assessment in minutes. No credit card or invite required.
Enterprise on-premises available · [email protected]