🌐
Werkzeug
werkzeug.palletsprojects.com › en › stable › debug
Debugging Applications — Werkzeug Documentation (3.1.x)
Enables debugging support for a given application: from werkzeug.debug import DebuggedApplication from myapp import app app = DebuggedApplication(app, evalex=True)
🌐
Medium
b33pl0g1c.medium.com › hacking-the-debugging-pin-of-a-flask-application-7364794c4948
Hacking the Debugging Pin of a Flask Application | by Akash Poudel | Medium
September 8, 2022 - But the bad news is that this debugging pin can be hacked.[but has some conditions!] Let me show you how. If we pull the source code for the werkzeug server, https://github.com/pallets/werkzeug/blob/main/src/werkzeug/debug/__init__.py Inside debug/__init__.py
🌐
GitHub
github.com › wdahlenburg › werkzeug-debug-console-bypass
GitHub - wdahlenburg/werkzeug-debug-console-bypass: Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. · GitHub
* Running on http://172.17.0.4:7777/ (Press CTRL+C to quit) * Restarting with stat User: werkzeug-user Module: flask.app Module Name: Flask App Location: /usr/local/lib/python3.9/site-packages/flask/app.py Mac Address: 2485377892356 Werkzeug Machine ID: b'ea1fc30b6f4a173cea015d229c6b55b69d0ff00819670374d7a02397bc236523a57e9bab0c6e6167470ac65b66075388' * Debugger is active!
Starred by 66 users
Forked by 8 users
Languages   Python 85.8% | Dockerfile 14.2%
🌐
SentinelOne
sentinelone.com › home › vulnerability database › cve-2024-34069
CVE-2024-34069: Werkzeug Debugger RCE Vulnerability
January 28, 2026 - If successful, this allows access to the debugger even when it is only running on localhost. Successful exploitation enables attackers to achieve remote code execution on developer machines through the Werkzeug debugger, potentially compromising development environments and source code repositories.
🌐
NIST
nvd.nist.gov › vuln › detail › cve-2024-34069
NVD - cve-2024-34069
May 6, 2024 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States
🌐
Readthedocs
werkzeug-docs-cn.readthedocs.io › zh-cn › latest › debug.html
Debugging Applications — Werkzeug 0.9.4 文档
You can enable the debugger by wrapping the application in a DebuggedApplication middleware. Additionally there are parameters to the run_simple() function to enable it because this is a common task during development. class werkzeug.debug.DebuggedApplication(app, evalex=False, request_key...
🌐
PyPI
pypi.org › project › Werkzeug
Werkzeug · PyPI
It began as a simple collection ... libraries. ... An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack....
      » pip install Werkzeug
    
Published   Apr 02, 2026
Version   3.1.8
🌐
Werkzeug
werkzeug.palletsprojects.com
Werkzeug — Werkzeug Documentation (3.1.x)
Werkzeug is a comprehensive WSGI web application library.
Find elsewhere
🌐
YouTube
youtube.com › 0xdf
Reassembling Werkzeug's Pin - Hacking Flask Debug Mode [Part 1] - YouTube
Flask is a really common Python web framework, and one of the features it offers is a debug mode. In this mode, when your application crashes, it gives not o...
Published   July 31, 2023
Views   3K
🌐
Medium
infosecwriteups.com › werkzeug-debugger-authentication-bypass-via-client-side-response-manipulation-d0f5a97b90f7
Werkzeug Debugger Authentication Bypass via Client-Side Response Manipulation | by AAKASH SHARMA | Medium
January 31, 2026 - For the uninitiated, Werkzeug is a WSGI web application library for Python. Its debugger is incredibly powerful — it allows you to run Python code directly in the browser to troubleshoot errors.
🌐
Rapid7
rapid7.com › db › modules › exploit › multi › http › werkzeug_debug_rce
Pallete Projects Werkzeug Debugger Remote Code ...
June 28, 2015 - Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone. The documentation states the following: "The debugger must never be used on production machines.
🌐
Pocoo
mitsuhiko.pocoo.org › werkzeug-docs › debug.html
Werkzeug Documentation
Enables debugging support for a given application: from werkzeug.debug import DebuggedApplication from myapp import app app = DebuggedApplication(app, evalex=True)
🌐
GitHub
github.com › pallets › werkzeug › blob › main › src › werkzeug › debug › __init__.py
werkzeug/src/werkzeug/debug/__init__.py at main · pallets/werkzeug
"""Enables debugging support for a given application:: · from werkzeug.debug import DebuggedApplication · from myapp import app · app = DebuggedApplication(app, evalex=True) · The ``evalex`` argument allows evaluating expressions in any frame ·
Author   pallets
🌐
HackTricks
hacktricks.wiki › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
2 days ago - A message regarding the “console locked” scenario is encountered when attempting to access Werkzeug’s debug interface, indicating a requirement for a PIN to unlock the console. The suggestion is made to exploit the console PIN by analyzing the PIN generation algorithm in Werkzeug’s debug initialization file (__init__.py).
🌐
GitHub
github.com › pallets › werkzeug › blob › main › src › werkzeug › debug › tbtools.py
werkzeug/src/werkzeug/debug/tbtools.py at main · pallets/werkzeug
<title>%(title)s // Werkzeug Debugger</title> <link rel="stylesheet" href="?__debugger__=yes&amp;cmd=resource&amp;f=style.css"> <link rel="shortcut icon" href="?__debugger__=yes&amp;cmd=resource&amp;f=console.png"> <script ...
Author   pallets
🌐
GitHub
github.com › pallets › werkzeug › security › advisories › GHSA-2g68-c3qc-8985
Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
May 5, 2024 - This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost.
🌐
Detectify
labs.detectify.com › home › writeups › how patreon got hacked – publicly exposed werkzeug debugger
How Patreon got hacked - publicly exposed Werkzeug Debugger
September 29, 2023 - What Shodan also exposed was that the Debugger got triggered, basically · presenting the visitor with a RCE-console right away on the domain’s root URL just by visiting the domain. Now, Werkzeug requires an actual error to trigger the console, as it uses a secret key generated when the application starts, which is only exposed in the Werkzeug Debugger page.