JSON Web Tokens
Summary: JWT4B is a Burp Suite extension, authored by Oussama Zgheb and at version 2.8.2 as of its 13 June 2025 update, that decodes and manipulates JSON web tokens on the fly, checks their validity, and automates common attacks. It stores settings in a config.json file under the user's home directory, regenerates that file with defaults if deleted, and requires a reload after changes, with a resetEditor option to preserve editor state across requests for Repeater testing.
Bottom line: The tooling to decode, tamper with, and automate attacks against JWTs is a free extension in the Burp BApp Store, so any weakness in how your applications validate these tokens is within reach of a tester with a standard toolkit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026