A Pokemon themed playground for learning real JWT attacks by actually doing them. Spin it up with Docker Compose and work through seven gyms, from no signature verification all the way to JWK injection and SQL injection via kid, each with hints and a built in token decoder to help you along the way.
-
Updated
Aug 17, 2026 - JavaScript