flask-werkzeug-attack

Name: flask-werkzeug-attack
Availability: InStock
Author: entrovyx

Probe Flask services for exposed Werkzeug debuggers and assess security misconfigurations.

3|1|Updated Jul 2, 2026

Search Tags:#debugging #vulnerability #flask #rce #werkzeug #recon

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill flask-werkzeug-attack-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: flask-werkzeug-attack
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/flask-werkzeug-attack
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill flask-werkzeug-attack-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the security risk of exposed Flask/Werkzeug debuggers in production environments, which can lead to sensitive information disclosure or remote code execution.

Core Features & Use Cases

Vulnerability Detection: Automatically identifies active Werkzeug debuggers by probing for common error-triggering paths and specific HTML signatures.
Information Gathering: Extracts server paths, framework versions, and source code context from leaked stack traces.
Exploitation Assessment: Determines if the debugger console is enabled and evaluates the feasibility of remote code execution via the EVALEX mechanism.

Quick Start

Use the flask-werkzeug-attack skill to probe the target domain for debugger exposure and extract available system information.

Frequently Asked Questions about flask-werkzeug-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect exposed Werkzeug debuggers in Flask applications?▼

To detect exposed Werkzeug debuggers, probe target web services for common error-triggering paths and analyze HTTP responses for specific HTML signatures indicating an active Flask debugger console.

What information can be leaked from a Flask Werkzeug traceback?▼

A Flask Werkzeug traceback discloses sensitive information including server file paths, framework versions, and source code context extracted directly from the leaked stack trace responses.

How does EVALEX enable remote code execution via Werkzeug?▼

EVALEX enables remote code execution by allowing arbitrary Python code execution directly within the browser-based Werkzeug debugger console when the debugger is exposed without proper authentication.

Can I check if a Werkzeug debugger console is enabled using curl?▼

Yes, you can check if a Werkzeug debugger console is enabled using curl to perform HTTP-based probing and analyze server responses for debugger activation markers.

What are the security risks of leaving Flask debug mode enabled in production?▼

Leaving Flask debug mode enabled in production introduces severe security risks, primarily sensitive information disclosure through stack traces and potential remote code execution via the Werkzeug console.