domains / families / security / hunt-django

hunt-django

separate

Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.

When to use

• Target uses Python/Django (indicated by `csrftoken` cookie, `/admin/` login, DRF browsable API, or `__debug__`toolbar).
• DRF API endpoints with class-based views and permission classes.
• Django Admin interface is reachable at `/admin/` or custom path.
• Celery task queues process user-supplied data.
• Django Channels WebSocket endpoints exist alongside REST API.

When not to use

• Guessing or brute-forcing SECRET_KEY

Skill page

Source