Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

Attacker-minded, 100% client-side JWT toolkit — decode, audit & forge tokens. Generates alg:none, key-confusion, kid-injection & brute-force attacks with ready-to-run curl/Burp/nuclei exports. The security alternative to jwt.io.

A complete bug bounty guide on Price Manipulation & Business Logic vulnerabilities — Basic to Ninja level, Attack Chaining, Mobile Testing, Bypasses, Report Templates & Checklist.

tool to test and exploit common JWT security issues such as weak signing keys, alg:none bypasses, and RS/HS confusion attacks.

A comprehensive JWT attack CLI covering every major vulnerability class — from alg:none bypass to RS256→HS256 algorithm confusion, HMAC secret bruteforce, kid header injection (SQLi + path traversal), jku/x5u spoofing with built-in JWKS server, and full token forgery. Built for bug bounty hunters and red teamers.

https://github.com/systemslibrarian/crypto-lab-jwt-forge3:45 PMcrypto-lab-jwt-forge — proper order, most-specific subject first:jwtBrowser-based JWT/JWS demo — paste or generate a token, tamper with claims, swap algorithms, and watch alg:none and HS/RS key-confusion attacks succeed against a vulnerable verifier and fail against a correct one. Re