flask-unsign

flask-unsign [options]

Flask-unsign is a security testing tool for analyzing and manipulating Flask session cookies. Flask stores session data in cryptographically signed cookies, and this tool can decode the contents, attempt to recover the secret key through brute-force attacks, and craft custom signed cookies.The tool is primarily used in web application security assessments to test Flask applications for weak secret keys. If the secret key can be recovered, attackers could forge arbitrary session data, potentially leading to privilege escalation or authentication bypass vulnerabilities.Flask-unsign supports multithreaded brute-forcing, custom wordlists, and both encoding and decoding operations. It can work with sessions even when the signature verification fails, allowing inspection of tampered or expired cookies.

--decode

Decode a session cookie and print its contents.

Brute-force the secret key from a signed session cookie.

Sign a cookie value with a known secret key.

Session cookie value to operate on.

Automatically fetch the session cookie from the given URL.

Secret key used to sign or verify a cookie.

Wordlist file to use for brute-forcing the secret key.

Number of threads to use during brute-forcing.

Skip signature verification when decoding.

Custom salt string (default: `cookie-session`).

Use the older itsdangerous signing algorithm for compatibility with older Flask apps.

Disable Python literal evaluation of wordlist entries.

flask(1), hashcat(1), john(1)