flask-unsign

library1.2.1pypypi✓ verified 85d ago

Penetration testing tool to decode and brute-force Flask session cookies by testing against a wordlist of common secret keys. Current version: 1.2.1. Release cadence is irregular, with the last release in 2022.

auth-security web-framework

pip install flask-unsign

github ↗package ↗

INSTALL

IMPORT

SIG · FLASK-UNSIGN

flask-unsign

auth-securitypythonv1.2.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Cracker

✓ from flask_unsign import Cracker

✗ from flask_unsign import UnsignSession

decode

✓ from flask_unsign import decode

sign

✓ from flask_unsign import sign

Decode a Flask session cookie or brute-force its secret key using a wordlist.

from flask_unsign import UnsignSession # Decode a session cookie (no secret needed) cookie = 'eyJ1c2VyIjoiYWRtaW4ifQ.XYZ...' unsign = UnsignSession() print(unsign.decode(cookie)) # Brute-force secret key using a wordlist wordlist = ['secret', 'key', 'password'] result = unsign.unsign(cookie, wordlist=wordlist) print(f"Secret found: {result}" if result else "Not found")

flask-unsign --version

Debug

Known issues

gotchaUnsignSession.unsign() expects a wordlist as a list of strings. Passing a file path will fail silently.

fix

Read the wordlist file into a list before passing: wordlist = [line.strip() for line in open('wordlist.txt')]

affects: <=1.2.1

gotchaThe tool does not support custom HTTP headers or proxies; it only extracts the session cookie string.

fix

Use requests or another library to fetch cookies, then pass the cookie value to flask-unsign.

affects: <=1.2.1

deprecatedThe command-line interface (flask-unsign --decode) is still available but not actively maintained. The Python API is preferred.

fix

Use the Python API with UnsignSession class.

affects: >=1.0.0

Upgrade

Version history

1.2.1latest on PyPI · released Dec 3, 2024

Audit

Dependencies

flaskrequiredRequired for Flask session format handling

Agent activity

29 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/Paradoxis/Flask-Unsign ↗

packagehttps://pypi.org/project/flask-unsign/ ↗