Strix•JWT 身份认证测试
Strix JWT 与 OIDC 安全测试手册,覆盖令牌伪造、算法混淆与声明篡改;触发名:strix-authentication-jwt
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-authentication-jwt --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Authentication / JWT / OIDC JWT/OIDC failures often enable token forgery, token confusion, cross-service acceptance, and durable account takeover. Do not trust headers, claims, or token opacity without strict validation bound to issuer, audience, key, and context. ## Attack Surface - Web/mobile/API authentication using JWT (JWS/JWE) and OIDC/OAuth2 - Access vs ID tokens, refresh tokens, device/PKCE/Backchannel flows - First-party and microservices verification, gateways, and JWKS distribution ## Reconnaissance ### Endpoints - Well-known: `/.well-known/openid-configuration`, `/oauth2/.well-known/openid-configuration` - Keys: `/jwks.json`, rotating key endpoints, tenant-specific JWKS - Auth: `/authorize`, `/token`, `/introspect`, `/revoke`, `/logout`, device code endpoints - App: `/login`, `/callback`, `/refresh`, `/me`, `/session`, `/impersonate` ### Token Features - Headers: `{"alg":"RS256","kid":"...","typ":"JWT","jku":"...","x5u":"...","jwk":{...}}` - Claims: `{"iss":"...","aud":"...","azp":"...","sub":"user","scope":"...","exp":...,"nbf":...,"iat":...}` - Formats: JWS (signed), JWE (encrypted). Note unencoded payload option (`"b64":false`) and critical headers (`"crit"`) ## Ke
- Attack Surface
- Reconnaissance
- Endpoints
- Token Features
- Key Vulnerabilities
- Signature Verification
- Header Manipulation
- Key and Cache Issues
- Claims Validation Gaps
- Token Confusion and OIDC
- Refresh and Session
- Transport and Storage
- Advanced Techniques
- Microservices and Gateways
What does the Strix•JWT 身份认证测试 skill do?
Strix JWT 与 OIDC 安全测试手册,覆盖令牌伪造、算法混淆与声明篡改;触发名:strix-authentication-jwt
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-authentication-jwt --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.