flask-unsign Documentation

Once the secret key is known, use the --sign flag to craft a new, valid session cookie. You must provide the desired session data (as a Python dictionary string) via --cookie and the discovered secret key via --secret.

$ flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME'

Use the --unsign flag to attempt to brute-force the server's secret key using a wordlist. You must provide a session cookie via the --cookie argument. The tool will attempt to find a key that matches the signature of the provided cookie.

$ flask-unsign --unsign --cookie < cookie.txt

Since Flask cookies are signed but not encrypted, you can decode them to view the session data. You can provide a specific cookie string via --cookie or let the tool attempt to grab a session automatically from a URL using --server.

# Decode a specific cookie
$ flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'

# Automatically grab a session from a server
$ flask-unsign --decode --server 'https://www.example.com/login'

Install the core flask-unsign package using pip. For full functionality including wordlists, install the [wordlist] extra. For development, install with the [test] extra.

# Install with wordlists (recommended)
$ pip3 install flask-unsign[wordlist]

# Install core only
$ pip3 install flask-unsign

# Install for development
$ pip3 install -e .[test]

Common issues and solutions:

• Crafted sessions fail on target: The server might use an older version of itsdangerous with a different timestamp generation algorithm. Use the --legacy option to generate older signatures.
• Wordlist errors: By default, wordlists expect newline-delimited Python strings (encapsulated in quotes). To disable this requirement, use the --no-literal-eval argument.
• Installation errors: If pip fails, try running python3.6 -m pip install flask-unsign (replace 3.6 with your specific Python version).