Flask Hacking Mastery

Set up a project environment with virtualenv, activate it with source bin/activate, and install Flask with pip to create an isolated workspace for building Flask apps.

Learn to build a basic Flask hello world app in Python using Visual Studio Code, define routes, and run the server to view results in a browser.

Explore routing in Flask by connecting links to functions and creating unique routes. Understand get and post requests, and render templates with render_template using a templates directory.

Master dynamic routes in flask by using a username parameter to render personalized greetings with f-strings, enabling interactive, user-driven pages.

Explore a Flask program that renders a profile page and demonstrates how server-side template injection (ssdi) can execute Python code and run Linux commands via malicious input, revealing shell access.

Enumerate a Flask web app by scanning for open ports, pinging the target, and using Nmap to reveal SSH and Flask on port 5000 as multiple entry points.

Explore brute forcing an SSH service with Hydra using common usernames and a rockyou password list, then assess login results and potential security implications.

Explore SSTI in a Flask web server, showing how dynamic url input and fuzzing can enable code execution on the server.

Flask's Jinja2 ssti can be exploited to access Python internals, navigate class hierarchies, and invoke subprocess to gain shell access on a Ubuntu server.

Learn how a Flask app's config variable can expose the secret key, enabling cookie manipulation and exploitation of a simple vulnerability.