JWT Token Testing

• Brute-forcing secret keys

• Default Secret key used - JWT HS256 secret value is secret

• Signing a new token with the “none” algorithm

• Changing the signing algorithm of the token (for fuzzing purposes)

• Signing the asymmetrically-signed token to its symmetric algorithm match (when you have the original public key)