Weak JWT secrets are still happening in production in 2024.If your target uses JWT, try:1. Decode at jwt.io — check algo & claims2. Change algo to "none" → send without signature3. Brute force the secret using hashcat:hashcat -a 0 -m 16500 <jwt> /wordlistTool: jwt_tool by ticarpi — supports many JWT attack vectors at once.You'll be surprised how many still use the secret "password" or "secret123".#jwt #webappsec #pentesting