Flask
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
Probably if you are playing a CTF a Flask application will be related to SSTI.
Cookies
Default cookie session name is session
.
Decoder
Online Flask coockies decoder: https://www.kirsle.net/wizards/flask-session.cgi
Manual
Get the first part of the cookie until the first point and Base64 decode it>
The cookie is also signed using a password
Flask-Unsign
Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.
Decode Cookie
Brute Force
Signing
Signing using legacy (old versions)
RIPsession
Command line tool to brute-force websites using cookies crafted with flask-unsign.
SQLi in Flask session cookie with SQLmap
This example uses sqlmap eval
option to automatically sign sqlmap payloads for flask using a known secret.
Flask Proxy to SSRF
In this writeup it's explained how Flask allows a request starting with the charcter "@":
Which in the following scenario:
Could allow to introduce something like "@attacker.com" in order to cause a SSRF.
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
Last updated