Django Attack Probe

Authorized probe of a Django (4.2+/5.x) app the user owns. Follow shared probing conventions — discover base URL via env / manage.py runserver default 8000 / Dockerfile EXPOSE / docker-compose.yml. Never hardcode the port.

Django-specific attack surface

• DEBUG=True in dev exposes a yellow error page with full traceback, environment variables, and SQL queries — often left on in non-prod-like environments.
• ALLOWED_HOSTS = ['*'] combined with Host: header trickery enables cache poisoning / password-reset link injection.
• /admin/ is the canonical admin path; brute-force lockout depends on django-axes/django-ratelimit being installed.
• DRF permission_classes default to project-wide setting — easy to leave AllowAny on a single ViewSet by accident.
• ModelSerializer with fields = "__all__" + update() enables mass-assignment of is_staff/is_superuser.
• Model.objects.raw() / extra(where=...) with f-strings is the typical SQLi vector in Django code.

Procedure

1. Authorization preflight + base URL discovery.
2. Liveness check: GET /, GET /admin/, GET /api/.
3. Run rules below.