Flask session cookie decoder
Decode and verify Flask’s itsdangerous session cookies, with automatic zlib detection and both key-derivation schemes.
Open in ctfpalFlask stores the whole session in the cookie, signed but not encrypted. Like a JWT, the contents are readable by anyone holding the cookie - so the first move on any Flask challenge is to decode your own session and see what the application is tracking.
Reading the format
The cookie is three dot-separated parts: payload, timestamp, signature. A leading . on the payload means it was zlib-compressed before Base64 encoding - decompress after decoding or you will see binary noise and conclude wrongly that it is encrypted.
- Payload - Base64-URL encoded JSON, optionally zlib-compressed.
- Timestamp - when it was signed, in itsdangerous' own epoch.
- Signature - HMAC over the first two, keyed by a value derived from the app’s
SECRET_KEY.
Forging needs the secret key
Reading is free; modifying requires the SECRET_KEY. Challenges leak it through debug pages, a git directory, an exposed config file, or by being weak enough to guess from a wordlist. Once you hold it, re-signing an arbitrary session - admin: true and all - is legitimate signing, and the application will accept it.
Related tools
JWT decoder and signature verifier
Decode a JSON Web Token’s header and payload and verify HS256/HS384/HS512 signatures against a known secret - all locally.
In-browser hash cracker with rule transforms
Crack MD5, SHA-1, SHA-256, SHA-384, and SHA-512 against a wordlist in your browser, with leetspeak, case, reversal, and digit-append rules.
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.