Offensive Security
Token & Session Security Review
Review a token's structure and generate session-security test cases - JWT decode/attack review, CSRF PoC, OAuth, WebSocket, race condition, Host header, API fuzz, and WAF test cases.
Keeps JWT, CSRF, OAuth, WebSocket, race-condition, Host header, API fuzz, and WAF guidance in one workbench. JWT Decoder and JWT Attack Review only run when the token field looks like a three-segment JWT; the optional URL is reused as the target for every other step (each tool falls back to its own placeholder target when left blank). Nothing here sends a live request to your target - every step returns a checklist or test-case list to replay yourself.
Tool chain
- JWT Decoder
- JWT Attack Toolkit
- CSRF PoC Generator
- OAuth 2.0 / OIDC Misconfiguration Tester
- WebSocket Security Tester
- Race Condition Tester
- Host Header Attack
- API Fuzzer
- WAF Test Payload Generator