ticarpi

I have this working in beta currently, and it works on keys with common configurations. I'm cleaning it up to make it work against more keys, and to integrate better...

Yes, I had this in a test the other week. I hacked a solution on the day, but I'll clean it up and add it to the next update. Thanks...

Nice one. Yes, this is a very narrow case, but it can happen. The regex `/eyJ./` matches the first block (4 chars) of base64 output for any string beginning with...

There's been a hold up in publication, so I can't reveal the vulnerable application. For now I can say that the exploit is an alternative signing method for JWTs signed...

The tool does accept a blank password with `-p ""` Or you can use the "blank password" exploit mode with `-X b` The same command works for me when substituting...

Hi all, thanks for your contributions. I have indeed been looking into enabling HTTP/2. It is worth mentioning that HTTP/2 is still not fully supported everywhere, and only works when...

Sorry for the slow response. What was in your token to cause this error? Can you supply an example? If it's going to affect others I'll happily patch it. You...

Shame that Burp uses a 200 response for error page. Trying to identify the cause here. Can you provide the command you used to run this? In particular where the...