sjord / jwtcrack Goto Github PK

Hi,
Really great work Sjoerd! I really appreciate the project and the efforts you have put into it. We would like to use the project for a commercial training online/classroom. So, I just wanted to clarify, if we acknowledge the source, would that be sufficient and covered under the terms of use?

This hmac-sha256 input string does not seem to be interpreted by john (with or without bleeding jumbo patches) following jwt2john even if forced to hmac-sha256. Any thoughts? What algorithms are supported? Maybe I am missing something?

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMGUyOWViNC1iYWNhLTRiMGItYWE3OS00YzlmMDMxMjg5NWQiLCJ1c2VySWQiOjUwNywidXNlclVpZCI6ImQzMjQwZGZmLTEwZTktNDM2MC05ZjdkLWE4YzdmOTllMzc4MSIsImVtYWlsIjoiYWxpY2UuZGF0YXNjaWVuY2VAZ3VhcmRzaWdodC5jb20iLCJyb2xlcyI6WyJTVEFOREFSRCJdLCJuYW1lIjoiQWxpY2UgR3VhcmRzaWdodCIsImlhdCI6MTQ5MDE0NTU3MH0.J0KJ3N7WwqE9MIL2nABdLVSfseej4BiUFREJl8eSUqU

$ echo -en 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' | base64 -d
{"alg":"HS256","typ":"JWT"}

$ jwt2john eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMGUyOWViNC1iYWNhLTRiMGItYWE3OS00YzlmMDMxMjg5NWQiLCJ1c2VySWQiOjUwNywidXNlclVpZCI6ImQzMjQwZGZmLTEwZTktNDM2MC05ZjdkLWE4YzdmOTllMzc4MSIsImVtYWlsIjoiYWxpY2UuZGF0YXNjaWVuY2VAZ3VhcmRzaWdodC5jb20iLCJyb2xlcyI6WyJTVEFOREFSRCJdLCJuYW1lIjoiQWxpY2UgR3VhcmRzaWdodCIsImlhdCI6MTQ5MDE0NTU3MH0.J0KJ3N7WwqE9MIL2nABdLVSfseej4BiUFREJl8eSUqU > hash.txt

$ john hash.txt
Using default input encoding: UTF-8
No password hashes loaded (see FAQ