CmdID

CmdID / Commands

flask-unsign

A tool to brute-force, decode, and craft Flask session cookies. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Decode a Flask session cookie

flask-unsign --decode --cookie cookieIdentify

Decode a session cookie fetched from a URL which returns a Set-Cookie header

flask-unsign --decode --server urlIdentify

Brute-force a secret key using the default flask-unsign-wordlist (requires flask-unsign-wordlist)

flask-unsign --unsign --cookie cookieIdentify

Brute-force a secret key with a custom wordlist (use --no-literal-eval for unquoted entries)

flask-unsign --unsign --cookie cookie --wordlist path/to/wordlist.txtIdentify

Sign a new session cookie with a secret key

flask-unsign --sign --cookie "{'logged_in': False}" --secret secretIdentify

Sign a session cookie using legacy timestamp (useful for old versions)

flask-unsign --sign --cookie "{'logged_in': False}" --secret secret --legacyIdentify

Brute-force a session cookie with custom threads and no literal evaluation

flask-unsign --unsign --cookie cookie --wordlist path/to/wordlist.txt --threads threads --no-literal-evalIdentify