hunt-django

name	hunt-django
description	Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["redteam","django","DRF","ORM","Python","admin","CSRF"]
related_skills	["hunt-sqli","hunt-ssti","hunt-idor","hunt-csrf"]

Django Security Hunting

Hunt Django-specific vulnerabilities focusing on Django REST Framework (DRF) permission class gaps, ORM raw query injection, template injection via |safe and mark_safe, and Django admin panel exploitation. Django's batteries-included approach creates unique attack surface: admin interface, ORM query building, DRF serializers, Channels WebSockets, and Celery task queues.

When to Use

• Target uses Python/Django (indicated by csrftoken cookie, /admin/ login, DRF browsable API, or __debug__toolbar).
• DRF API endpoints with class-based views and permission classes.
• Django Admin interface is reachable at /admin/ or custom path.
• Celery task queues process user-supplied data.
• Django Channels WebSocket endpoints exist alongside REST API.

Quick Detection

# Django fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/admin/login/" | grep -iE "csrftoken|sessionid|django"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'csrftoken|__debug__|django'

Procedure

Phase 1 — DRF Permission Class Gaps

# DRF list vs retrieve vs custom @action — each may have different permissions
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/"          # list: may be restricted
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1/"        # retrieve: may leak individual
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/me/"       # me: may work without auth

# Custom @action endpoints often miss permission checks
# Test common DRF action names
for action in "export" "import" "bulk" "search" "stats" "report" \
                 ; 
  curl --max-time 30 --connect-timeout 10 -sk -X POST  \
    -w  -o /dev/null