Flask
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F129538173-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-L_2uGJGU7AVNRcqRvEi%252Fuploads%252FRWchATuJ6MkgmHM3yqYl%252Fimage.png%3Falt%3Dmedia%26token%3D293fc517-abaa-4a6a-b8ea-2a1fea473554&width=768&dpr=4&quality=100&sign=e3717b39&sv=1)
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
Probably if you are playing a CTF a Flask application will be related to SSTI.
Cookies
Default cookie session name is session
.
Decoder
Online Flask coockies decoder: https://www.kirsle.net/wizards/flask-session.cgi
Manual
Get the first part of the cookie until the first point and Base64 decode it>
The cookie is also signed using a password
Flask-Unsign
Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.
Decode Cookie
Brute Force
Signing
Signing using legacy (old versions)
RIPsession
Command line tool to brute-force websites using cookies crafted with flask-unsign.
SQLi in Flask session cookie with SQLmap
This example uses sqlmap eval
option to automatically sign sqlmap payloads for flask using a known secret.
Flask Proxy to SSRF
In this writeup it's explained how Flask allows a request starting with the charcter "@":
Which in the following scenario:
Could allow to introduce something like "@attacker.com" in order to cause a SSRF.
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F129538173-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-L_2uGJGU7AVNRcqRvEi%252Fuploads%252FRWchATuJ6MkgmHM3yqYl%252Fimage.png%3Falt%3Dmedia%26token%3D293fc517-abaa-4a6a-b8ea-2a1fea473554&width=768&dpr=4&quality=100&sign=e3717b39&sv=1)
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated