Sign Up for Free

RunKit +

Try any Node.js package right in your browser

This is a playground to test code. It runs a full Node.js environment and already has all of npm’s 400,000 packages pre-installed, including distributed-jwt-cracker with all npm packages installed. Try it out:

distributed-jwt-cracker lists no main file and has no index.js, so it can't be directly required. If this is a mistake, please let us know. It may however contain internal files that you can require manually:

// require("distributed-jwt-cracker/[??]")

This service is provided by RunKit and is not affiliated with npm, Inc or the package authors.

distributed-jwt-cracker v1.0.0

An experimental distributed JWT token cracker built using Node.js and ZeroMQ

distributed-jwt-cracker

An experimental distributed JWT token cracker built using Node.js and ZeroMQ. It can be used to discover the password (or "secret") of an unencrypted JWT token using a HS256 signature.

npm version Build Status codecov.io

Install

Through NPM:

npm i -g distributed-jwt-cracker

Requires ZeroMq libraries to be already installed in your machine.

Usage

Server

To start a new server:

jwt-cracker-server <jwtToken> [options]

The following options are available:

optiondescriptiontypedefault
-p, --portThe port used to accept incoming connectionsnumber9900
-P, --pubPortThe port used to publish signals to all the workersnumber9901
-a, --alphabetThe alphabet used to generate the passwordsstring"abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789"
-b, --batchSizeThe number of attempts assigned to every client in a batchnumber1000000
-s, --startThe index from where to start the searchnumber0

Example, using the example JWT.io token over a simple alphabet:

jwt-cracker-server eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ -a=abcdefghijklmnopqrstuwxyz

Client

To start a new client:

jwt-cracker-client [options]

The following options are available:

optiondescriptiontypedefault
-h, --hostThe hostname of the serverstring"localhost"
-p, --portThe port used to connect to the batch servernumber9900
-P, --pubPortThe port used to subscribe to broadcast signals (e.g. exit)number9901

Example:

jwt-cracker-client --host=localhost --port=9900 --pubPort=9901

The making of

This project has been thoroughly discussed in two articles published on RisingStack community blog:

ZeroMQ & Node.js Tutorial - Cracking JWT Tokens

Contributing

Everyone is very welcome to contribute to this project. You can contribute just by submitting bugs or suggesting improvements by opening an issue on GitHub.

License

Licensed under MIT License. © Luciano Mammino.

RunKit is a free, in-browser JavaScript dev environment for prototyping Node.js code, with every npm package installed. Sign up to share your code.
Sign Up for Free