flask-unsign

What it is and what it does

Flask-Unsign is a penetration testing utility designed to test Flask application security by attempting to recover or forge session cookies. It decodes Flask's signed (but not encrypted) session data, brute-forces the server's secret key against wordlists of common keys, and can craft new session cookies once a key is found. The tool operates as a command-line utility and depends on Flask, itsdangerous, and related web framework libraries.

The package is intended for authorized security testing and development environments. It reads session cookies from HTTP responses or accepts them directly, then attempts to match the signature against a wordlist of known or guessed secret keys. Once a match is found, you can generate new signed session data with arbitrary content. The tool includes options for handling older itsdangerous versions (--legacy flag) and custom wordlist formats.

Use it for:

• Test your own Flask application's session security by attempting to recover the secret key with common wordlists.
• Decode and inspect Flask session data during development and debugging without knowing the secret key.
• Authorized penetration testing to verify whether a Flask server uses weak or publicly known secret keys.
• Forge custom session cookies to test authorization logic and access control in Flask applications.
• Verify that session management is properly implemented before deploying a Flask application to production.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Command-line tool to decode, brute-force, and forge Flask session cookies by attempting to guess or verify the server's secret key against wordlists.

Yes, if you are conducting authorized security testing or developing Flask applications and need to verify session security. The low install friction and permissive license make it accessible. However, maintenance is dormant (last release 619 days ago), so expect no active support; use it for one-off testing rather than as a dependency in production code. Not suitable for general-purpose use outside security testing contexts.

Install

flask-unsign on PyPI

pip install flask-unsign

uv add flask-unsign

poetry add flask-unsign

Installing flask-unsign

Before you install

Low install friction with a pure-Python wheel. Maintenance is dormant—last release was 619 days ago, though the repository remains active with a recent commit on 2024-12-03. Suitable for one-off testing but not for ongoing development.

License in practice

MIT license is permissive; you can use, modify, and distribute this tool freely in commercial and private projects with minimal restrictions, provided you retain the license notice.

Quickstart

pip install flask-unsign
flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'
flask-unsign --unsign --cookie < cookie.txt

Requires Python 3.6 or later. Wordlist-based brute-forcing requires a newline-delimited wordlist file or the optional [wordlist] extra.

Verify before relying

• Whether the tool works reliably against modern Flask/itsdangerous versions without the --legacy flag.
• Performance characteristics when brute-forcing against large wordlists on typical hardware.
• Compatibility with Flask applications using custom session serialization or signing algorithms.

Package facts

Evidence: flask_unsign-1.2.1-py3-none-any.whl

Tags

More Security packages