HackPack CTF - Forging Python Flask Session Cookies

[sysclls]

Just a small comment, you could just offline brute force the secret key using the original session cookie you get from the site and compare it to what you generate, this way you don't need to brute force the remote server and it will make brute forcing faster (because it's not over the network).
Aside from that, great video as always, thanks alot for what you are doing for the community, you are awesome!

[-willplaysgames]

I’m learning so much from this channel. Thanks so much.

[mostafanasser]

you make me wanna go learn python so hard right now after seeing the power of this programming language

[viv_]

Wonderful video thanks, this walkthrough helped me to solve picoctf "more cookies" challenge which is based on flask cookie...

[IAmOxidised]

Also we can observe the header values, server:meinheld/1.0.1, so we can deduct that certainly at the backend a sandboxed python backend must be at work, this could be an python sandbox vulnerability or SSTI .

[crassProgrammer]

This is awesome. I like the way you get going with things and find out the right path. I like your python skills man. I do love python but i am merely a beginner. Keep doing such videos. Thank you very much 😊

[tricky]

Very new to pretty much all of this ... seems to slowly makes sense very fun to watch and informative 👍

[manoharbaratam]

I really loved your videos.. its worth watching.. kudos to your programming skills.. keep doing more.. keep entertaining and encouraging us.. Love from INDIA

[arcanj]

I just discovered you some days ago and I love your content. It's not the area I work, but who knows in future? Anyway, knowledge is knowledge, right? Keep up the good work.

[wilcosec]

I thought for sure this was going to be a situation where they don't verify the signature, so you could just set the flagship key to true in Burp and be on your way. But it was great seeing your python script!

[Vogel]

You could have verified the signature offline, only the correct secret will generate a valid signature.

[kalelsoffspring]

Any possibility of going over how to complete this without brute force? I'd be very interested in seeing that :)

Also, yeah, a lot of people have mentioned it already, but offline has verification probably would've been cleaner. Overall, great vid. Love your content

[GeekBatman]

I thought you said there was no brute forcing? Did I mishear?

[lordtony]

I did those Pico ctf flask ones. You don't actually need to send it to the server over and over again. Because you have a cookie, you can just take the data out of the cookie then sign it with all of the Rock you passwords, and check to see if the token you get from signing it is equal to the token the website gave you. Once you have the secret key that way, then you can forge a different one and send only one request back to the server.

It's still brute-forcing, but you don't need to hammer the server. Also it's like a million times faster to do it locally. If the password had been the 10 millionth one in rockyou.txt, hammering the server would take too long.

Am I explaining that clearly?

[daanbreur]

Nicee. i wasnt able to do it. Now i know how to do it :)

[CybrJames]

How in the hell did you learn all this stuff? Just WOW. Very impressive. I feel dumb, just watching. lol

[passivecryptoearnings]

Any websites like THM, HTB and HackPack CTF? thx.

[Andrei-dsqv]

Is it possible to solve those challagnes today? Or the competition has ended and they are no longer available?

[_sp]

You can bruteforce it locally by doing this:


from itsdangerous import Signer
import hashlib
#Load rockyou.txt
wanted_signature = #The last part of the cookie (SIGNATURE)
encoded_plus_timestamp = #First part of the cookie
for password in rockyou:
s = Signer(password, salt="cookie-session", key_derivation="hmac", digest_method=hashlib.sha1) #Found the params though some source digging :)
if == wanted_signature:
print(f"Secret key is: {password}!")
break



This is much faster and there is no need to hammer the server :)

[theohenson]

Great vid, but for the love of God please choose either single or double quotes