vulnhub

Vulnerable Flask-API script

Vulnerabilities

1. easy to guess secret key
2. jwt session similar for users of the same first name

SETUP ON UBUNTU

• cloning and virtualenv setup

git clone https/github.com/noodle-lover/vulnhub
cd vulnhub
virtualenv venv
source /venv/bin/activate 
# make sure its activated by running `which python` and `which pip`
cd flaskapp

• make sure to set environment variable before flask run

export FLASK_APP=blog.py 
# if you want debug mode `export FLASK_ENV=development`
pip install -r requirements.txt
flask run

• MongoDB Setup
  • install mongodb following the official doc
  • install mongodb compass ubuntu
  • create database named flaskapp and table/collection named accounts
  • import the sample json data - sample_db.json into accounts