Django debug port active

---

Description

Write Up: Guillaume
Créateur: WOCSA
Difficulté: Inconnu

---

Enoncé

Deploying a Django application with ‘Debug = True’ in a production environment is risky. It exposes sensitive information and could potentially allow attackers to gather details about your application’s structure, such as database schema or internal code. This can be a security risk as attackers might exploit these vulnerabilities to compromise the system. Therefore, it’s crucial to set ‘Debug = False’ in production to enhance security.

---

Solution détaillée

Exploitation

Description of each of the exploitation steps

PoC

Reach http://wg2d3m2w.3xploit.me/reset_password/ without account would trigger an error on django because of Debug = True, there is many endpoint that send a debug to a user

Risk

These error can be used by attacker to get recon and informations, like full path discolure, env, source code ....

Remediation

Disable Debug = True

---