Werkzeug
werkzeug.palletsprojects.com › en › stable › debug
Debugging Applications — Werkzeug Documentation (3.1.x)
Enables debugging support for a given application: from werkzeug.debug import DebuggedApplication from myapp import app app = DebuggedApplication(app, evalex=True)
Werkzeug PIN exploit - TryHackMe's OWASP Top 10 2021
37:21
DANGEROUS Python Flask Debug Mode Vulnerabilities - YouTube
15:27
Workerbee Walkthrough (Werkzeug Debug Pin generation) - YouTube
03:33
What is Werkzeug and debug mode on and off | REST APIs Development ...
01:26:38
HackTheBox - Ellingson - YouTube
GitHub
github.com › wdahlenburg › werkzeug-debug-console-bypass
GitHub - wdahlenburg/werkzeug-debug-console-bypass: Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. · GitHub
* Running on http://172.17.0.4:7777/ (Press CTRL+C to quit) * Restarting with stat User: werkzeug-user Module: flask.app Module Name: Flask App Location: /usr/local/lib/python3.9/site-packages/flask/app.py Mac Address: 2485377892356 Werkzeug Machine ID: b'ea1fc30b6f4a173cea015d229c6b55b69d0ff00819670374d7a02397bc236523a57e9bab0c6e6167470ac65b66075388' * Debugger is active!
Starred by 66 users
Forked by 8 users
Languages Python 85.8% | Dockerfile 14.2%
SentinelOne
sentinelone.com › home › vulnerability database › cve-2024-34069
CVE-2024-34069: Werkzeug Debugger RCE Vulnerability
January 28, 2026 - If successful, this allows access to the debugger even when it is only running on localhost. Successful exploitation enables attackers to achieve remote code execution on developer machines through the Werkzeug debugger, potentially compromising development environments and source code repositories.
NIST
nvd.nist.gov › vuln › detail › cve-2024-34069
NVD - cve-2024-34069
May 6, 2024 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States
Readthedocs
werkzeug-docs-cn.readthedocs.io › zh-cn › latest › debug.html
Debugging Applications — Werkzeug 0.9.4 文档
You can enable the debugger by wrapping the application in a DebuggedApplication middleware. Additionally there are parameters to the run_simple() function to enable it because this is a common task during development. class werkzeug.debug.DebuggedApplication(app, evalex=False, request_key...
PyPI
pypi.org › project › Werkzeug
Werkzeug · PyPI
It began as a simple collection ... libraries. ... An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack....
» pip install Werkzeug
Werkzeug
werkzeug.palletsprojects.com
Werkzeug — Werkzeug Documentation (3.1.x)
Werkzeug is a comprehensive WSGI web application library.
YouTube
youtube.com › 0xdf
Reassembling Werkzeug's Pin - Hacking Flask Debug Mode [Part 1] - YouTube
Flask is a really common Python web framework, and one of the features it offers is a debug mode. In this mode, when your application crashes, it gives not o...
Published July 31, 2023 Views 3K
Rapid7
rapid7.com › db › modules › exploit › multi › http › werkzeug_debug_rce
Pallete Projects Werkzeug Debugger Remote Code ...
June 28, 2015 - Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone. The documentation states the following: "The debugger must never be used on production machines.
Published Jun 28, 2015
Pocoo
mitsuhiko.pocoo.org › werkzeug-docs › debug.html
Werkzeug Documentation
Enables debugging support for a given application: from werkzeug.debug import DebuggedApplication from myapp import app app = DebuggedApplication(app, evalex=True)
GitHub
github.com › pallets › werkzeug › blob › main › src › werkzeug › debug › __init__.py
werkzeug/src/werkzeug/debug/__init__.py at main · pallets/werkzeug
"""Enables debugging support for a given application:: · from werkzeug.debug import DebuggedApplication · from myapp import app · app = DebuggedApplication(app, evalex=True) · The ``evalex`` argument allows evaluating expressions in any frame ·
Author pallets
HackTricks
hacktricks.wiki › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
2 days ago - A message regarding the “console locked” scenario is encountered when attempting to access Werkzeug’s debug interface, indicating a requirement for a PIN to unlock the console. The suggestion is made to exploit the console PIN by analyzing the PIN generation algorithm in Werkzeug’s debug initialization file (__init__.py).
GitHub
github.com › pallets › werkzeug › blob › main › src › werkzeug › debug › tbtools.py
werkzeug/src/werkzeug/debug/tbtools.py at main · pallets/werkzeug
<title>%(title)s // Werkzeug Debugger</title> <link rel="stylesheet" href="?__debugger__=yes&cmd=resource&f=style.css"> <link rel="shortcut icon" href="?__debugger__=yes&cmd=resource&f=console.png"> <script ...
Author pallets
Top answer 1 of 4
5
Your approach was nearly correct. I am using the following code to open the response text in a new window (not specific to Werkzeug or Flask at all):
var w = window.open('', 'debug_stuff', 'width=540,height=150');
w.document.open();
w.document.write(response.responseText);
w.document.close();
The last line is the most important. Without it, the code would behave as yours -- it would not execute any JavaScript, because the browser doesn't know the DOM has been fully loaded.
2 of 4
1
Not javascript, but have you tried to use Firebug, you can use the option for viewing the response in a new tab (Open Response in New Tab).
Detectify
labs.detectify.com › home › writeups › how patreon got hacked – publicly exposed werkzeug debugger
How Patreon got hacked - publicly exposed Werkzeug Debugger
September 29, 2023 - What Shodan also exposed was that the Debugger got triggered, basically · presenting the visitor with a RCE-console right away on the domain’s root URL just by visiting the domain. Now, Werkzeug requires an actual error to trigger the console, as it uses a secret key generated when the application starts, which is only exposed in the Werkzeug Debugger page.