flask-pentesting

name

flask-pentesting

description

How to exploit Flask web application vulnerabilities including session cookie manipulation, secret key brute-forcing, and SSRF attacks. Use this skill whenever the user mentions Flask applications, session cookies, web pentesting, SSTI vulnerabilities, or needs to decode/sign/craft Flask session cookies. Make sure to use this skill for any Flask-related security testing, cookie analysis, or web application exploitation tasks.

Flask Pentesting

A skill for exploiting Flask web application vulnerabilities, focusing on session cookie manipulation, secret key brute-forcing, and SSRF attacks.

When to Use This Skill

Use this skill when:

• You encounter a Flask web application during pentesting or CTF challenges
• You need to decode, analyze, or craft Flask session cookies
• You suspect Flask SSTI (Server-Side Template Injection) vulnerabilities
• You need to brute-force Flask secret keys
• You're testing for Flask proxy SSRF vulnerabilities
• You have Flask session cookies that need manipulation

Flask Session Cookie Exploitation

Understanding Flask Cookies

Flask uses signed session cookies by default. The session cookie name is typically session. The cookie format is:

<base64-encoded-data>.<signature>.<additional-data>

Manual Cookie Decoding

To decode a Flask session cookie manually:

1. Extract the first part of the cookie (before the first dot)
2. Base64 decode it

# Example: decode the payload portion
echo "ImhlbGxvIg" | base64 -d

Using Flask-Unsign

Flask-unsign is a command-line tool for decoding, brute-forcing, and crafting Flask session cookies.