Decoding, Brute-Forcing and Crafting Flask Session Cookies - "web-intro" [DefCamp CTF 2022]

Video walkthrough for the "web-intro" challenge from the @DefCampRO Capture The Flag (D-CTF) competition 2021/2022. In this challenge we brute-force a Flask cookie secret with the flask-unsign library and forge a new one to get past the "Access Denied" web page. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #DefCamp #DCTF #CTF #Pentesting #OffSec

↢Social Media↣
Twitter: https://twitter.com/_CryptoCat
GitHub: https://github.com/Crypto-Cat
HackTheBox: https://app.hackthebox.eu/profile/11897
LinkedIn: https://www.linkedin.com/in/cryptocat
Reddit: https://www.reddit.com/user/_CryptoCat23
YouTube: https://www.youtube.com/CryptoCat23
Twitch: https://www.twitch.tv/cryptocat23

↢D-CTF↣
https://dctf21.cyberedu.ro/
https://def.camp/
https://twitter.com/DefCampRO
https://discord.gg/uGr3eFxrwE
https://ctftime.org/event/1560

↢Resources↣
Ghidra: https://ghidra-sre.org/CheatSheet.html
Volatility: https://github.com/volatilityfoundation/volatility/wiki/Linux
PwnTools: https://github.com/Gallopsled/pwntools-tutorial
CyberChef: https://gchq.github.io/CyberChef
DCode: https://www.dcode.fr/en
HackTricks: https://book.hacktricks.xyz/pentesting/pentesting-web/flask
CTF Tools: https://github.com/apsdehal/awesome-ctf
Forensics: https://cugu.github.io/awesome-forensics
Decompile Code: https://www.decompiler.com
Run Code: https://tio.run

↢Chapters↣
Start: 0:00
Investigate session cookie: 0:40
Research Flask: 1:37
Install flask-unsign: 2:35
Brute-force cookie secret: 3:20
Craft new session cookie: 4:32
End: 4:57

Видео Decoding, Brute-Forcing and Crafting Flask Session Cookies - "web-intro" [DefCamp CTF 2022] канала CryptoCat