Flask
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-78abb7891633b1e8147b4e743e4f00af375d3cd6%252Fimage%2520%28515%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=15264a5e&sv=1)
Tumia Trickest kujenga na kujiendesha kazi kwa urahisi kwa kutumia zana za jamii zilizoendelea zaidi duniani. Pata Ufikiaji Leo:
Labda ikiwa unacheza CTF, programu ya Flask itahusiana na SSTI.
Cookies
Jina la kikao cha cookie la default ni session
.
Decoder
Decoder ya cookie za Flask mtandaoni: https://www.kirsle.net/wizards/flask-session.cgi
Manual
Pata sehemu ya kwanza ya cookie hadi nukta ya kwanza na uifanye Base64 decode>
Keki pia imesainiwa kwa kutumia nenosiri
Flask-Unsign
Zana ya mstari wa amri ya kupata, kufungua, kujaribu nguvu, na kuunda keki za kikao za programu ya Flask kwa kubashiri funguo za siri.
Fasiri Keki
Brute Force
Kusaini
Kusaini kwa kutumia toleo la zamani (old versions)
RIPsession
Zana ya mistari ya amri ya kulazimisha tovuti kwa kutumia vidakuzi vilivyoundwa na flask-unsign.
SQLi katika Flask session cookie na SQLmap
Mfano huu unatumia chaguo la sqlmap eval
ili kusaini kiotomatiki payloads za sqlmap kwa flask kwa kutumia siri inayojulikana.
Flask Proxy kwa SSRF
Katika andiko hili inaelezwa jinsi Flask inavyoruhusu ombi lianze na herufi "@":
Katika mojawapo ya hali zifuatazo:
Could allow to introduce something like "@attacker.com" in order to cause a SSRF.
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-78abb7891633b1e8147b4e743e4f00af375d3cd6%252Fimage%2520%28515%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=15264a5e&sv=1)
Tumia Trickest kujenga na kujiendesha kazi kwa urahisi zikiwa na zana za jamii za kisasa zaidi duniani. Pata Ufikiaji Leo:
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated