Hacking Flask Session Cookie

Introduction

The cookie used to store session data is known session cookie. Flask signs the session cookie. It means that anyone can view the contents of the cookie, but can’t modify the cookie unless he has the secret key used to sign the cookie.

Information By: https://overiq.com/flask-101/sessions-in-flask/

Cookie Format

eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoic2Fsc2EifQ.YyhE4w.9zyLlE4V6ZM8XCHzzFU9jyV9h4g

It’s Flask Session Cookie JWT?

NO, I know that they seem to have the same syntax, but it is not the same, the big doubt is because jwt.io can decrypt the flask session, however once decrypted you can see that the syntax is different. The big difference in the use of JWT to Flask, is that Flask cookies store the signature and user information on the client side of the cookie. In JWT you can choose where you want to store it.

Laboratory

The lab we will use will be a HackTheBox machine called Noter. We will also use a tool called flask unsign.

I think Flask Unsign it’s only preinstalled in Parrot OS, in Kali Linux I don’t have, to install you only need to run this command:

pip3 install flask-unsign

Detection

First of all in a pentesting it is important whenever we log in to see the cookie. In this case we take it and see this:

It looks like a JWT, we tried to run it through my tool to parse JWT information, but we received an error…

After seeing this it seems strange, but let’s try to do it with jwt.io

Here works but that’s not the typically structure from JWT, the headers are data and data i don’t know what is it…

Seeing that we are against a python server, it occurs to me that it could be a Django, but then we confirm that it is not, that we are against a Flask.

To know how to exploit Flask i go to my favorite guide Hacktricks and here i can see in the first part one important thing…

Seeing this, it means that if with the flask-unsign tool I can decrypt the session cookie, we already know what to exploit and how to exploit it.

Let’s try…

Command

flask-unsign --decode --cookie 'cookie'

Result:

Perfect, we already know what this cookie is and we have several options on how to exploit this.

Exploitation

Okey, with the cookie decoded it’s time to try a brute force attack to discover the secret of this cookie and then we can forge a new cookie with different values.

Command

flask-unsign --wordlist rockyou.txt --unsign --cookie 'cookie' --no-literal-eval

Result:

Perfect!!!

The secret is “secret123”.

It’s the moment to try to log in as admin, to do this i need to create new cookie session with username value admin:

Command

flask-unsign --sign --cookie "{'logged_in': True, 'username': 'admin'}" --secret 'secret123'

Result:

Let’s try to change in web…

Cookie Hijacking Completed!

Conclusions

Finally, you can see that it is not a very typical attack, this attack can not be executed too many times but it is very good for when you have to attack a Flask you know a possible attack vector.

Thanks to read this :)

S12.