Hello World
Whoami
Pentest
Cloud
Antivirus Evasion - Defender
EDR BYPASS
Red Team
CTF

Powered by GitBook

On this page

Brute force cookie
Wordlists
SSTI

Was this helpful?

Flask

PreviousDjango NextTomcat (8080)

Last updated 18 days ago

Brute force cookie

flask-unsign --unsign --cookie 'eyJsb2d<-SNIP->Wr3EW6Nuc' -w /usr/share/wordlists/rockyou.txt --no-literal-eval

Wordlists

SSTI

Flask leverages Jinja2 Templates

GitHub - Paradoxis/Flask-Unsign: Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.GitHub

Flask | HackTricks

Flask-Unsign-Wordlist/flask_unsign_wordlist/wordlists at master · Paradoxis/Flask-Unsign-WordlistGitHub