> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# JSON Web Tokens (JWT)

> Recursos cross-platform para JSON Web Tokens (JWT): máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

# JSON Web Tokens (JWT)

Esta página agrega los **recursos para practicar JSON Web Tokens (JWT)** de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

## Recursos curados

| Fuente      | Enlace                                                                               |
| ----------- | ------------------------------------------------------------------------------------ |
| PortSwigger | [https://portswigger.net/web-security/jwt](https://portswigger.net/web-security/jwt) |

## Máquinas HTB que practican JSON Web Tokens (JWT) (10)

| Máquina                                                  | SO      | Dificultad                                           |
| -------------------------------------------------------- | ------- | ---------------------------------------------------- |
| [Backend](/htb/machines/linux/medio/backend)             | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [BackendTwo](/htb/machines/linux/medio/backendtwo)       | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Breadcrumbs](/htb/machines/windows/dificil/breadcrumbs) | Windows | <span className="dbadge dbadge-hard">HARD</span>     |
| [Epsilon](/htb/machines/linux/medio/epsilon)             | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Noter](/htb/machines/linux/medio/noter)                 | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [OverGraph](/htb/machines/linux/dificil/overgraph)       | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [Player](/htb/machines/linux/dificil/player)             | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [Secret](/htb/machines/linux/facil/secret)               | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [TheNotebook](/htb/machines/linux/medio/thenotebook)     | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Unicode](/htb/machines/linux/medio/unicode)             | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |

## Labs PortSwigger que practican JSON Web Tokens (JWT) (8)

| Lab                                                                                                                                                                                      | Dificultad                                                 | Topic                 | Oficial                                                                                                                                         |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| [JWT authentication bypass via algorithm confusion](/portswigger/labs/jwt/algorithm-confusion-jwt-authentication-bypass-via-algorithm-confusion)                                         | <span className="dbadge dbadge-easy">APPRENTICE</span>     | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/algorithm-confusion/lab-jwt-authentication-bypass-via-algorithm-confusion)                     |
| [JWT authentication bypass via algorithm confusion with no exposed key](/portswigger/labs/jwt/algorithm-confusion-jwt-authentication-bypass-via-algorithm-confusion-with-no-exposed-key) | <span className="dbadge dbadge-easy">APPRENTICE</span>     | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/algorithm-confusion/lab-jwt-authentication-bypass-via-algorithm-confusion-with-no-exposed-key) |
| [JWT authentication bypass via flawed signature verification](/portswigger/labs/jwt/jwt-authentication-bypass-via-flawed-signature-verification)                                         | <span className="dbadge dbadge-easy">APPRENTICE</span>     | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification)                               |
| [JWT authentication bypass via unverified signature](/portswigger/labs/jwt/jwt-authentication-bypass-via-unverified-signature)                                                           | <span className="dbadge dbadge-easy">APPRENTICE</span>     | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature)                                        |
| [JWT authentication bypass via jku header injection](/portswigger/labs/jwt/jwt-authentication-bypass-via-jku-header-injection)                                                           | <span className="dbadge dbadge-medium">PRACTITIONER</span> | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection)                                        |
| [JWT authentication bypass via jwk header injection](/portswigger/labs/jwt/jwt-authentication-bypass-via-jwk-header-injection)                                                           | <span className="dbadge dbadge-medium">PRACTITIONER</span> | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection)                                        |
| [JWT authentication bypass via kid header path traversal](/portswigger/labs/jwt/jwt-authentication-bypass-via-kid-header-path-traversal)                                                 | <span className="dbadge dbadge-medium">PRACTITIONER</span> | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-kid-header-path-traversal)                                   |
| [JWT authentication bypass via weak signing key](/portswigger/labs/jwt/jwt-authentication-bypass-via-weak-signing-key)                                                                   | <span className="dbadge dbadge-medium">PRACTITIONER</span> | JWT (JSON Web Tokens) | [Abrir](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-weak-signing-key)                                            |

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"JSON Web Tokens (JWT)","termCode":"jwt-attacks","inLanguage":"es","url":"https://rootea.es/skills/jwt-attacks","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"Máquinas HTB que practican JSON Web Tokens (JWT)","numberOfItems":10,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/htb/machines/linux/medio/backend","name":"Backend"},{"@type":"ListItem","position":2,"url":"https://rootea.es/htb/machines/linux/medio/backendtwo","name":"BackendTwo"},{"@type":"ListItem","position":3,"url":"https://rootea.es/htb/machines/windows/dificil/breadcrumbs","name":"Breadcrumbs"},{"@type":"ListItem","position":4,"url":"https://rootea.es/htb/machines/linux/medio/epsilon","name":"Epsilon"},{"@type":"ListItem","position":5,"url":"https://rootea.es/htb/machines/linux/medio/noter","name":"Noter"},{"@type":"ListItem","position":6,"url":"https://rootea.es/htb/machines/linux/dificil/overgraph","name":"OverGraph"},{"@type":"ListItem","position":7,"url":"https://rootea.es/htb/machines/linux/dificil/player","name":"Player"},{"@type":"ListItem","position":8,"url":"https://rootea.es/htb/machines/linux/facil/secret","name":"Secret"},{"@type":"ListItem","position":9,"url":"https://rootea.es/htb/machines/linux/medio/thenotebook","name":"TheNotebook"},{"@type":"ListItem","position":10,"url":"https://rootea.es/htb/machines/linux/medio/unicode","name":"Unicode"}]}`}
</script>

*Última actualización: 2026-06-07*