Skip to content

Commit aafa538

Browse files
chawdamrunalchawdamrunal
committed
Add landing page with Open Graph tags for social media
 previews
1 parent d74e064 commit aafa538

1 file changed

Lines changed: 298 additions & 0 deletions

File tree

‎index.html‎

Lines changed: 298 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>JWTLens - Comprehensive JWT Security Scanner for Burp Suite</title>
7+
<meta name="description" content="JWTLens is a Burp Suite extension that automatically detects and tests JWTs for security vulnerabilities. 62 security checks covering passive scanning, algorithm confusion, signature bypass, KID injection, weak secret brute force, and a built-in JWT Forge tab.">
8+
<meta name="keywords" content="jwt scanner, jwt security, burp suite extension, jwt decoder, jwt vulnerability, jwt brute force, algorithm confusion, jwt forge, penetration testing, jwt analyzer">
9+
10+
<!-- Open Graph / Facebook -->
11+
<meta property="og:type" content="website">
12+
<meta property="og:url" content="https://chawdamrunal.github.io/JWTLens/">
13+
<meta property="og:title" content="JWTLens - Comprehensive JWT Security Scanner for Burp Suite">
14+
<meta property="og:description" content="Burp Suite extension with 62 security checks — passive scanning, algorithm confusion, signature bypass, KID injection, weak secret brute force, and a built-in JWT Forge tab.">
15+
<meta property="og:image" content="https://github.com/user-attachments/assets/d462bafc-1131-4695-90ef-6066ef537e0f">
16+
<meta property="og:image:width" content="1200">
17+
<meta property="og:image:height" content="630">
18+
<meta property="og:site_name" content="JWTLens">
19+
20+
<!-- Twitter -->
21+
<meta name="twitter:card" content="summary_large_image">
22+
<meta name="twitter:url" content="https://chawdamrunal.github.io/JWTLens/">
23+
<meta name="twitter:title" content="JWTLens - Comprehensive JWT Security Scanner for Burp Suite">
24+
<meta name="twitter:description" content="Burp Suite extension with 62 security checks — passive scanning, algorithm confusion, signature bypass, KID injection, weak secret brute force, and a built-in JWT Forge tab.">
25+
<meta name="twitter:image" content="https://github.com/user-attachments/assets/d462bafc-1131-4695-90ef-6066ef537e0f">
26+
27+
<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Cdefs%3E%3ClinearGradient id='g'%3E%3Cstop stop-color='%23667eea'/%3E%3Cstop offset='1' stop-color='%23764ba2'/%3E%3C/linearGradient%3E%3C/defs%3E%3Ccircle cx='16' cy='16' r='14' fill='none' stroke='url(%23g)' stroke-width='2'/%3E%3Ctext x='16' y='20' text-anchor='middle' font-size='8' font-weight='bold' fill='url(%23g)'%3EJWT%3C/text%3E%3C/svg%3E">
28+
<style>
29+
* { margin: 0; padding: 0; box-sizing: border-box; }
30+
body {
31+
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
32+
background: linear-gradient(135deg, #0f0c29, #302b63, #24243e);
33+
color: #e0e0e0;
34+
min-height: 100vh;
35+
}
36+
a { color: #7c8cf8; text-decoration: none; }
37+
a:hover { text-decoration: underline; }
38+
39+
.hero {
40+
text-align: center;
41+
padding: 60px 20px 40px;
42+
}
43+
.hero img {
44+
max-width: 700px;
45+
width: 100%;
46+
border-radius: 12px;
47+
margin-bottom: 24px;
48+
}
49+
.hero h1 {
50+
font-size: 2.4rem;
51+
background: linear-gradient(135deg, #667eea, #764ba2);
52+
-webkit-background-clip: text;
53+
-webkit-text-fill-color: transparent;
54+
margin-bottom: 12px;
55+
}
56+
.hero p {
57+
font-size: 1.15rem;
58+
color: #b0b0c0;
59+
max-width: 720px;
60+
margin: 0 auto 28px;
61+
line-height: 1.6;
62+
}
63+
.btn-row {
64+
display: flex;
65+
gap: 16px;
66+
justify-content: center;
67+
flex-wrap: wrap;
68+
}
69+
.btn {
70+
display: inline-block;
71+
padding: 12px 28px;
72+
border-radius: 8px;
73+
font-weight: 600;
74+
font-size: 1rem;
75+
transition: transform 0.15s, box-shadow 0.15s;
76+
}
77+
.btn:hover { transform: translateY(-2px); box-shadow: 0 6px 20px rgba(102,126,234,0.3); text-decoration: none; }
78+
.btn-primary { background: linear-gradient(135deg, #667eea, #764ba2); color: #fff; }
79+
.btn-outline { border: 2px solid #667eea; color: #667eea; }
80+
81+
.container { max-width: 1000px; margin: 0 auto; padding: 0 20px 60px; }
82+
83+
.stats {
84+
display: flex;
85+
justify-content: center;
86+
gap: 40px;
87+
flex-wrap: wrap;
88+
padding: 40px 20px;
89+
}
90+
.stat {
91+
text-align: center;
92+
}
93+
.stat-num {
94+
font-size: 2.4rem;
95+
font-weight: 700;
96+
background: linear-gradient(135deg, #667eea, #764ba2);
97+
-webkit-background-clip: text;
98+
-webkit-text-fill-color: transparent;
99+
}
100+
.stat-label { color: #888; font-size: 0.9rem; margin-top: 4px; }
101+
102+
h2 {
103+
font-size: 1.6rem;
104+
margin: 48px 0 20px;
105+
color: #fff;
106+
}
107+
108+
.features {
109+
display: grid;
110+
grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
111+
gap: 20px;
112+
margin-top: 20px;
113+
}
114+
.feature-card {
115+
background: rgba(255,255,255,0.05);
116+
border: 1px solid rgba(255,255,255,0.08);
117+
border-radius: 12px;
118+
padding: 24px;
119+
}
120+
.feature-card h3 {
121+
color: #7c8cf8;
122+
font-size: 1.1rem;
123+
margin-bottom: 8px;
124+
}
125+
.feature-card p {
126+
color: #999;
127+
font-size: 0.92rem;
128+
line-height: 1.55;
129+
}
130+
131+
.checks-grid {
132+
display: grid;
133+
grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
134+
gap: 12px;
135+
margin-top: 16px;
136+
}
137+
.check-item {
138+
background: rgba(255,255,255,0.04);
139+
border-radius: 8px;
140+
padding: 14px;
141+
font-size: 0.9rem;
142+
color: #b0b0c0;
143+
}
144+
.check-item strong { color: #e0e0e0; }
145+
146+
.install-block {
147+
background: rgba(0,0,0,0.3);
148+
border: 1px solid rgba(255,255,255,0.08);
149+
border-radius: 12px;
150+
padding: 24px;
151+
margin-top: 20px;
152+
}
153+
.install-block code {
154+
display: block;
155+
background: rgba(0,0,0,0.4);
156+
padding: 16px;
157+
border-radius: 8px;
158+
color: #7c8cf8;
159+
font-size: 0.95rem;
160+
margin-top: 12px;
161+
overflow-x: auto;
162+
}
163+
.install-block p { color: #999; line-height: 1.6; }
164+
165+
.screenshots {
166+
display: grid;
167+
grid-template-columns: repeat(auto-fit, minmax(440px, 1fr));
168+
gap: 20px;
169+
margin-top: 20px;
170+
}
171+
.screenshots img {
172+
width: 100%;
173+
border-radius: 10px;
174+
border: 1px solid rgba(255,255,255,0.1);
175+
}
176+
.screenshots figcaption {
177+
text-align: center;
178+
color: #888;
179+
font-size: 0.85rem;
180+
margin-top: 8px;
181+
}
182+
183+
footer {
184+
text-align: center;
185+
padding: 40px 20px;
186+
color: #666;
187+
font-size: 0.85rem;
188+
border-top: 1px solid rgba(255,255,255,0.06);
189+
}
190+
191+
@media (max-width: 600px) {
192+
.hero h1 { font-size: 1.6rem; }
193+
.hero p { font-size: 1rem; }
194+
.stats { gap: 24px; }
195+
.stat-num { font-size: 1.8rem; }
196+
.screenshots { grid-template-columns: 1fr; }
197+
}
198+
</style>
199+
</head>
200+
<body>
201+
202+
<section class="hero">
203+
<img src="https://github.com/user-attachments/assets/d462bafc-1131-4695-90ef-6066ef537e0f" alt="JWTLens logo banner">
204+
<h1>JWTLens</h1>
205+
<p>Comprehensive JWT Security Scanner for Burp Suite. Automatically detects and tests JSON Web Tokens for security vulnerabilities with 62 checks &mdash; no manual effort required.</p>
206+
<div class="btn-row">
207+
<a href="https://github.com/chawdamrunal/JWTLens" class="btn btn-primary">View on GitHub</a>
208+
<a href="https://github.com/chawdamrunal/JWTLens#installation" class="btn btn-outline">Installation Guide</a>
209+
</div>
210+
</section>
211+
212+
<div class="stats">
213+
<div class="stat"><div class="stat-num">62</div><div class="stat-label">Security Checks</div></div>
214+
<div class="stat"><div class="stat-num">23</div><div class="stat-label">Passive Checks</div></div>
215+
<div class="stat"><div class="stat-num">33</div><div class="stat-label">Active Checks</div></div>
216+
<div class="stat"><div class="stat-num">6</div><div class="stat-label">Secret Extraction</div></div>
217+
<div class="stat"><div class="stat-num">200+</div><div class="stat-label">Built-in Secrets</div></div>
218+
</div>
219+
220+
<div class="container">
221+
222+
<h2>Key Features</h2>
223+
<div class="features">
224+
<div class="feature-card">
225+
<h3>JWT Forge Tab</h3>
226+
<p>A live jwt.io-style editor built into Burp. Edit headers & claims, re-sign with any algorithm, export as cURL or Python. Cracked secrets auto-fill instantly.</p>
227+
</div>
228+
<div class="feature-card">
229+
<h3>Passive Secret Extraction</h3>
230+
<p>Automatically finds hardcoded JWT secrets, RSA/EC private keys, inline JWKS, and Base64-encoded secrets from JS, JSON, and HTML responses.</p>
231+
</div>
232+
<div class="feature-card">
233+
<h3>Real JWKS Parsing</h3>
234+
<p>Algorithm confusion attacks use the server's actual public key from JWKS endpoints &mdash; not generated keys. This means attacks actually work on real targets.</p>
235+
</div>
236+
<div class="feature-card">
237+
<h3>Full Passive Scanning</h3>
238+
<p>23 checks run automatically on every request/response through Burp Proxy. No other JWT extension does this. Zero manual effort required.</p>
239+
</div>
240+
<div class="feature-card">
241+
<h3>KID Injection Testing</h3>
242+
<p>SQL injection (UNION SELECT, error-based), command injection (time-based), LDAP injection, and path traversal with 10+ traversal paths.</p>
243+
</div>
244+
<div class="feature-card">
245+
<h3>Smart Deduplication</h3>
246+
<p>Tracks unique JWTs per host. Browse 50 pages with the same token and get one set of findings, not 50. Clear cache anytime from the UI.</p>
247+
</div>
248+
</div>
249+
250+
<h2>What It Covers</h2>
251+
<div class="checks-grid">
252+
<div class="check-item"><strong>Signature Bypass</strong><br>Algorithm None, invalid sig, stripping, null bytes, payload modification</div>
253+
<div class="check-item"><strong>Weak Keys</strong><br>Empty secret, 200+ secret brute force, weak RSA key size detection</div>
254+
<div class="check-item"><strong>Algorithm Attacks</strong><br>RS256→HS256 confusion, cross-algorithm signing, forged public key</div>
255+
<div class="check-item"><strong>Header Injection</strong><br>JWK, JKU, X5U, X5C injection with SSRF pingback detection</div>
256+
<div class="check-item"><strong>KID Injection</strong><br>Path traversal, SQL injection, command injection, LDAP injection</div>
257+
<div class="check-item"><strong>Token & Claims</strong><br>Expired token acceptance, claim tampering, subject enumeration, clock skew</div>
258+
<div class="check-item"><strong>Cookie Security</strong><br>Missing HttpOnly, Secure, SameSite flags on JWT cookies</div>
259+
<div class="check-item"><strong>CVEs</strong><br>CVE-2022-21449 Psychic Signatures, ECDSA signature malleability</div>
260+
</div>
261+
262+
<h2>Screenshots</h2>
263+
<div class="screenshots">
264+
<figure>
265+
<img src="images/jwtlense01.png" alt="JWTLens Burp site map with JWT findings">
266+
<figcaption>Site map with JWT findings</figcaption>
267+
</figure>
268+
<figure>
269+
<img src="images/jwtlense02.png" alt="JWTLens scanner tab with findings table">
270+
<figcaption>Findings dashboard with 62 checks</figcaption>
271+
</figure>
272+
<figure>
273+
<img src="images/jwtlense03.png" alt="JWTLens context menu">
274+
<figcaption>Right-click context menu</figcaption>
275+
</figure>
276+
<figure>
277+
<img src="images/jwtlense04.png" alt="JWT Forge tab with live token editor">
278+
<figcaption>JWT Forge tab &mdash; live editor with signing</figcaption>
279+
</figure>
280+
</div>
281+
282+
<h2>Quick Start</h2>
283+
<div class="install-block">
284+
<p><strong>Prerequisites:</strong> Java 17+ and Burp Suite Professional or Community (2024.1+)</p>
285+
<code>git clone https://github.com/chawdamrunal/JWTLens.git
286+
cd JWTLens/jwtlens-burp
287+
./gradlew clean jar</code>
288+
<p style="margin-top: 16px;">Load <strong>build/libs/jwtlens-1.0.0.jar</strong> in Burp Suite → Extensions → Add. Two new tabs appear: <strong>JWTLens</strong> and <strong>JWT Forge</strong>.</p>
289+
</div>
290+
291+
</div>
292+
293+
<footer>
294+
MIT License &bull; Built by the JWTLens team &bull; <a href="https://github.com/chawdamrunal/JWTLens">GitHub</a>
295+
</footer>
296+
297+
</body>
298+
</html>

0 commit comments

Comments
 (0)