DANGEROUS Python Flask Debug Mode Vulnerabilities

Help the channel grow with a Like, Comment, & Subscribe!
Check out the affiliates below for more free or discounted learning!

📧Contact me! (I may be very slow to respond or completely unable to)

[seanvinsick]

# in a url is a page anchor. Like for a long webpage, clicking the link will jump to a specific section of the webpage. It's ignore for the actual file retrieval portion of the request

[Jayme]

This one really hits home because I use flask for most my projects.

[NAKPzmGOsBgWKH]

Yes! The Legend!! :D Interesting with the debug mode.. Heard of it in Flask but never encountered it :)

[motbus]

Your videos improved a lot. I like that you are straightforward on what's really going on.
Thanks !

[Yotanido]

The bit after # in an URL is called a fragment

[TheJobCompany]

I'm actually curious; if we have arbitrary file read, can't we read the stdout or stderr of the flask server and get the PIN from /proc/self/fd/{1, 2} instead?

Update: we probably cannot do that because the process is still running and the stdout stream is not terminated by an eof, which means the when the file is being read, it's likely gonna wait for the eof, but that will never happen until the process terminates, so the request hangs.

[MeMyselfAndBob]

That was very cool John!! I am working on a Flask for Python web app. This video gave me great insight in some security issues! Thanks!

[TheHOWeb]

Thanks John ! Just realized I miss your old outro music so I went to some previous video and enjoyed 😛

[_kutur]

Hey John, just wanted to say one thing that the snake in the thumbnail is not python but a bush viper.

[justinboss]

Awesome... enjoyed this.... starting to understand more of your hacks as I learn about building web apps

[sandra]

Thank you John Hammond I will have checked out my python in learning this and have I got the right hack the Box I can't get it to Lead the first time and when it does it doesn't look right

[twinsdzn]

Qardden token and amazon signed a partnership. It will blow up once it hits mainstream.

[Lampe]

12:58 You could try if the console is already usable while just hidden behind the PIN because it's rendered, so maybe if you just remove the pin input popup from the DOM you could use the console?

[mrmonday]

I honestly only use flask as the python equivalent to express, make rest api's or websocket servers, backend stuff, but always turn off debug mode in prod

[HTWwpzIuqaObMt]

Awesome video. I am making a flask app exploitation tool and I will add that for sure.

[ThapeloPilusaThePoet]

by any ans, but I can make what I envision, and that's the greatest gift to . You are, without a doubt, an expert teacher. You may

[pitachu_s]

Nice learning some new python tricks :D

[henrym]

the /proc and /sys folders almost look like magic

[kiwiwelch]

Love love love the clear video quality and content

[NetworkGamerBoy]

Nice one John and thank you for this content.