{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"Command-line tool to decode, brute-force, and forge Flask session cookies by attempting to guess or verify the server's secret key against wordlists.","skillfed_tags":["penetration-testing","flask-security","session-management"],"use_cases":["Test your own Flask application's session security by attempting to recover the secret key with common wordlists.","Decode and inspect Flask session data during development and debugging without knowing the secret key.","Authorized penetration testing to verify whether a Flask server uses weak or publicly known secret keys.","Forge custom session cookies to test authorization logic and access control in Flask applications.","Verify that session management is properly implemented before deploying a Flask application to production."],"what_it_does":"Flask-Unsign is a penetration testing utility designed to test Flask application security by attempting to recover or forge session cookies. It decodes Flask's signed (but not encrypted) session data, brute-forces the server's secret key against wordlists of common keys, and can craft new session cookies once a key is found. The tool operates as a command-line utility and depends on Flask, itsdangerous, and related web framework libraries.\n\nThe package is intended for authorized security testing and development environments. It reads session cookies from HTTP responses or accepts them directly, then attempts to match the signature against a wordlist of known or guessed secret keys. Once a match is found, you can generate new signed session data with arbitrary content. The tool includes options for handling older itsdangerous versions (--legacy flag) and custom wordlist formats.","worth_installing":"Yes, if you are conducting authorized security testing or developing Flask applications and need to verify session security. The low install friction and permissive license make it accessible. However, maintenance is dormant (last release 619 days ago), so expect no active support; use it for one-off testing rather than as a dependency in production code. Not suitable for general-purpose use outside security testing contexts."},"id":"flask-unsign","links":{"html":"https://skillfed.io/packages/flask-unsign","md":"https://skillfed.io/packages/flask-unsign.md","pypi":"https://pypi.org/project/flask-unsign/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2024-12-03","license_spdx":null,"license_treatment":"permissive","name":"flask-unsign","python_support":"supports_current","summary":"Flask Unsign is a penetration testing utility that attempts to uncover a Flask server's secret key by taking a signed session verifying it against a wordlist of commonly used and publicly known secret keys (sourced from books, GitHub, StackOverflow and various other sources)."},"popularity":{"monthly_downloads":101208,"position":12955,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.2.1"}