# Pre-Reconnaissance Report

## Port Discovery (naabu)
Status: Skipped
[object Object]

## Network Scanning (nmap)
Status: success
Starting Nmap 7.97 ( https://nmap.org ) at 2025-10-27 10:29 -0700
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000027s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 994 closed tcp ports (conn-refused)
PORT      STATE SERVICE         VERSION
80/tcp    open  http            Caddy httpd
|_http-server-header: Caddy
|_http-title: Site doesn't have a title.
443/tcp   open  ssl/https
|_http-title: Site doesn't have a title.
631/tcp   open  ipp             CUPS 2.3
|_http-server-header: CUPS/2.3 IPP/2.1
|_http-title: Home - CUPS 2.3.4
5003/tcp  open  http            Werkzeug httpd 3.0.3 (Python 3.8.17)
|_http-server-header: Werkzeug/3.0.3 Python/3.8.17
| http-title: MedGuard
|_Requested resource was /login
8888/tcp  open  sun-answerbook?
49158/tcp open  http            Golang net/http server
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 401 Unauthorized
|     Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; script-src 'none'; script-src-elem 'none'; script-src-attr 'none'
|     Content-Type: text/plain; charset=utf-8
|     Tailscale-Cap: 115
|     Tailscale-Version: 1.82.5-tdec88625e-gec2eb9730
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: DENY
|     Date: Mon, 27 Oct 2025 17:29:58 GMT
|     Content-Length: 14
|     auth required
|   GenericLines, Help, RTSPRequest, SSLSessionReq: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest, HTTPOptions: 
|     HTTP/1.0 401 Unauthorized
|     Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; script-src 'none'; script-src-elem 'none'; script-src-attr 'none'
|     Content-Type: text/plain; charset=utf-8
|     Tailscale-Cap: 115
|     Tailscale-Version: 1.82.5-tdec88625e-gec2eb9730
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: DENY
|     Date: Mon, 27 Oct 2025 17:29:43 GMT
|     Content-Length: 14
|_    auth required
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port49158-TCP:V=7.97%I=7%D=10/27%Time=68FFAC07%P=arm-apple-darwin24.4.0
SF:%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:
SF:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20
SF:Bad\x20Request")%r(GetRequest,192,"HTTP/1\.0\x20401\x20Unauthorized\r\n
SF:Content-Security-Policy:\x20default-src\x20'none';\x20frame-ancestors\x
SF:20'none';\x20script-src\x20'none';\x20script-src-elem\x20'none';\x20scr
SF:ipt-src-attr\x20'none'\r\nContent-Type:\x20text/plain;\x20charset=utf-8
SF:\r\nTailscale-Cap:\x20115\r\nTailscale-Version:\x201\.82\.5-tdec88625e-
SF:gec2eb9730\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x2
SF:0DENY\r\nDate:\x20Mon,\x2027\x20Oct\x202025\x2017:29:43\x20GMT\r\nConte
SF:nt-Length:\x2014\r\n\r\nauth\x20required\n")%r(HTTPOptions,192,"HTTP/1\
SF:.0\x20401\x20Unauthorized\r\nContent-Security-Policy:\x20default-src\x2
SF:0'none';\x20frame-ancestors\x20'none';\x20script-src\x20'none';\x20scri
SF:pt-src-elem\x20'none';\x20script-src-attr\x20'none'\r\nContent-Type:\x2
SF:0text/plain;\x20charset=utf-8\r\nTailscale-Cap:\x20115\r\nTailscale-Ver
SF:sion:\x201\.82\.5-tdec88625e-gec2eb9730\r\nX-Content-Type-Options:\x20n
SF:osniff\r\nX-Frame-Options:\x20DENY\r\nDate:\x20Mon,\x2027\x20Oct\x20202
SF:5\x2017:29:43\x20GMT\r\nContent-Length:\x2014\r\n\r\nauth\x20required\n
SF:")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type
SF::\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x2
SF:0Bad\x20Request")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nCont
SF:ent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r
SF:\n400\x20Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x
SF:20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnectio
SF:n:\x20close\r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,192,"HTT
SF:P/1\.0\x20401\x20Unauthorized\r\nContent-Security-Policy:\x20default-sr
SF:c\x20'none';\x20frame-ancestors\x20'none';\x20script-src\x20'none';\x20
SF:script-src-elem\x20'none';\x20script-src-attr\x20'none'\r\nContent-Type
SF::\x20text/plain;\x20charset=utf-8\r\nTailscale-Cap:\x20115\r\nTailscale
SF:-Version:\x201\.82\.5-tdec88625e-gec2eb9730\r\nX-Content-Type-Options:\
SF:x20nosniff\r\nX-Frame-Options:\x20DENY\r\nDate:\x20Mon,\x2027\x20Oct\x2
SF:02025\x2017:29:58\x20GMT\r\nContent-Length:\x2014\r\n\r\nauth\x20requir
SF:ed\n");

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 93.67 seconds


## Subdomain Discovery (subfinder)
Status: success
www.localhost
naeu2.naeuinc.localhost
mail.localhost
autodiscover.regency.localhost
mail02.regency.localhost
mse-ca-mail.corp.mse.localhost
owa.regency.localhost
tools.sonoma.edu.localhost
exchvm.nwcnet.localhost
server02.counterintel.localhost
fndlync01.5ninesdata.localhost
autodiscover.localhost
sbs.allsaintsschool.localhost
server2.hunter.localhost
mail03.regency.localhost
mail.regency.localhost


## Technology Detection (whatweb)
Status: success
[1m[34mhttp://localhost:45121[0m [200 OK] [1mHTML5[0m, [1mHTTPServer[0m[[1m[36mWSGIServer/0.2 CPython/3.9.24[0m], [1mIP[0m[[0m[22m::1[0m], [1mTitle[0m[[1m[33mGreeting App[0m], [1mUncommonHeaders[0m[[0m[22mx-content-type-options,referrer-policy[0m], [1mX-Frame-Options[0m[[0m[22mDENY[0m]

## Code Analysis
# Penetration Test Scope & Boundaries

**Primary Directive:** This analysis is strictly limited to the **network-accessible attack surface** of the application. All subsequent tasks must adhere to this scope. Before reporting any finding (e.g., an entry point, a vulnerability sink), it has been verified to meet the "In-Scope" criteria.

### In-Scope: Network-Reachable Components
A component is considered **in-scope** if its execution can be initiated, directly or indirectly, by a network request that the deployed application server is capable of receiving. This includes:
- Publicly exposed web pages and API endpoints.
- Endpoints requiring authentication via the application's standard login mechanisms.
- Any developer utility, debug console, or script that has been mistakenly exposed through a route or is otherwise callable from other in-scope, network-reachable code.

### Out-of-Scope: Locally Executable Only
A component is **out-of-scope** if it **cannot** be invoked through the running application's network interface and requires an execution context completely external to the application's request-response cycle. This includes tools that must be run via:
- A command-line interface (e.g., `go run ./cmd/...`, `python scripts/...`).
- A development environment's internal tooling (e.g., a "run script" button in an IDE).
- CI/CD pipeline scripts or build tools (e.g., Dagger build definitions).
- Database migration scripts, backup tools, or maintenance utilities.
- Local development servers, test harnesses, or debugging utilities.
- Static files or scripts that require manual opening in a browser (not served by the application).

---

## 1. Executive Summary

This Django 3.2 web application presents a **CRITICAL security risk** with a severe Server-Side Template Injection (SSTI) vulnerability that directly exposes sensitive flag data. The application is a minimalist web service with only three network-accessible endpoints (`/`, `/greet/`, `/admin/`), but suffers from fundamental security misconfigurations including DEBUG mode enabled, hardcoded secrets, lack of HTTPS enforcement, and absence of rate limiting.

The most critical finding is the `/greet/` endpoint which concatenates unsanitized user input directly into Django template strings before compilation, allowing attackers to inject template syntax and extract the FLAG variable from the template context. This vulnerability is compounded by the flag being loaded from `/flag.txt` and exposed in every request's template context. Additional high-severity issues include secrets committed to version control, FLAG values visible in Docker image history, and complete absence of encryption for data at rest or in transit.

The application runs on Django's development server (not production-grade) over HTTP only, with no Web Application Firewall, rate limiting, or intrusion detection. The attack surface is minimal but the single exploitable endpoint provides immediate access to sensitive data without authentication. This application would fail any security audit and requires immediate remediation before any production deployment.

---

## 2. Architecture & Technology Stack

### Framework & Language

**Core Technology Stack:**
- **Framework:** Django 3.2 (LTS version, released April 2021)
- **Python Version:** 3.9-slim (containerized) / 3.12.10 (development host)
- **Web Server:** Django development server (`runserver` on port 8000)
- **WSGI Server:** None (using Django's built-in development server)
- **Database:** SQLite 3 (file-based, located at `/app/db.sqlite3`)

**Dependencies:** The application has a remarkably minimal footprint with only one explicit dependency in `requirements.txt`:
```
Django==3.2
```

**Security Implications:**
- Django 3.2 has known CVEs and is approaching end of standard support (April 2024)
- No security-hardening libraries present (no django-ratelimit, django-defender, django-cors-headers)
- No API framework (no Django REST Framework, GraphQL, or similar)
- No async task processor (no Celery, Redis Queue)
- Development server used instead of production WSGI server (Gunicorn, uWSGI)
- Minimal third-party attack surface, but also minimal security tooling

### Architectural Pattern

**Pattern:** Minimalist Django monolith with traditional server-side rendering  
**Type:** Simple web application with form-based user interaction

**Application Structure:**
```
app/
├── Dockerfile                  # Container definition with FLAG embedded
├── manage.py                   # Django CLI (not network-accessible)
├── requirements.txt            # Single dependency: Django==3.2
├── templates/                  # HTML templates
│   ├── greet.html             # Greeting display (unused)
│   └── index.html             # Landing page with name input form
└── webapp/                     # Django project package
    ├── __init__.py            # Empty module initializer
    ├── settings.py            # Configuration (116 lines) - CRITICAL misconfigurations
    ├── urls.py                # URL routing (3 routes total)
    ├── views.py               # Request handlers (17 lines) - SSTI vulnerability
    └── wsgi.py                # WSGI application entry point
```

**Trust Boundary Analysis:**

1. **External Network → Application (Port 8000)**
   - Entry point: Docker exposes port 8000 via `docker-compose.yml`
   - No reverse proxy, load balancer, or WAF in front
   - Direct access to Django application
   - No TLS termination layer
   - Trust boundary: ANY network client can reach application

2. **Application → Template Engine**
   - **CRITICAL TRUST BOUNDARY VIOLATION:** User input from `request.GET.get("name")` is concatenated directly into template string before compilation
   - Django template engine processes untrusted content as code
   - FLAG variable exposed in template context
   - File: `/app/webapp/views.py` line 9

3. **Application → Filesystem**
   - Application reads `/flag.txt` without access controls
   - SQLite database at `BASE_DIR / 'db.sqlite3'` accessible to application process
   - No encryption layer between application and filesystem
   - Trust assumption: Filesystem is secure (violated in container environments)

4. **Build Argument → Container Image**
   - FLAG passed as Docker build argument
   - Persists in image layers and visible via `docker history`
   - Trust boundary: Anyone with image access can extract FLAG
   - File: `/app/Dockerfile` lines 14-15

### Critical Security Components

**Middleware Stack** (File: `/app/webapp/settings.py` lines 33-41):

```python
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',      # Security headers
    'django.contrib.sessions.middleware.SessionMiddleware', # Session handling
    'django.middleware.common.CommonMiddleware',           # URL normalization
    'django.middleware.csrf.CsrfViewMiddleware',          # CSRF protection
    'django.contrib.auth.middleware.AuthenticationMiddleware', # Auth
    'django.contrib.messages.middleware.MessageMiddleware',    # Flash messages
    'django.middleware.clickjacking.XFrameOptionsMiddleware',  # X-Frame-Options
]
```

**Security Analysis:**

✅ **Present Security Middleware:**
- **SecurityMiddleware:** Provides basic security headers (but not configured for HTTPS)
- **CsrfViewMiddleware:** CSRF token protection for state-changing requests (but bypassed by GET-based SSTI)
- **XFrameOptionsMiddleware:** Clickjacking protection via X-Frame-Options header
- **AuthenticationMiddleware:** Session-based authentication (only used for Django admin)

❌ **Missing Critical Security Controls:**
- No rate limiting middleware (unlimited requests to any endpoint including admin login)
- No IP-based access control or geofencing
- No request throttling or circuit breakers
- No WAF or input validation middleware
- No security event logging middleware
- No custom security headers (CSP, HSTS configuration missing)

⚠️ **Critical Vulnerability Context:**
The `/greet/` endpoint bypasses CSRF protection because it accepts GET requests (`request.GET.get("name")`), and CSRF middleware only protects POST/PUT/PATCH/DELETE methods. This allows unauthenticated SSTI exploitation without any CSRF token requirement.

**Security Header Configuration Gaps** (File: `/app/webapp/settings.py`):

The following Django security settings are **NOT configured** (using insecure defaults):
```python
# MISSING SECURITY CONFIGURATIONS:
SECURE_SSL_REDIRECT = False          # No HTTPS enforcement
SECURE_HSTS_SECONDS = 0              # No HTTP Strict Transport Security
SECURE_HSTS_INCLUDE_SUBDOMAINS = False
SECURE_HSTS_PRELOAD = False
SESSION_COOKIE_SECURE = False        # Session cookies sent over HTTP
CSRF_COOKIE_SECURE = False           # CSRF tokens sent over HTTP
CSRF_COOKIE_HTTPONLY = False         # JavaScript can access CSRF token
SECURE_CONTENT_TYPE_NOSNIFF = False  # No X-Content-Type-Options
SECURE_BROWSER_XSS_FILTER = False    # No X-XSS-Protection header
SECURE_REFERRER_POLICY = None        # No Referrer-Policy header
# Content-Security-Policy: Not configured at all
```

**Critical Misconfigurations** (File: `/app/webapp/settings.py`):

1. **DEBUG Mode Enabled (Line 16):**
   ```python
   DEBUG = True
   ```
   **Impact:** Exposes detailed error pages with full stack traces, environment variables, settings configuration, database queries, file paths, and installed packages to any attacker triggering an exception.

2. **Hardcoded SECRET_KEY (Line 13):**
   ```python
   SECRET_KEY = 'django-insecure-+@i)-n58!b8#v^)-+s!8$#l@7z%b^!52rrn4kl+^9-@riokc5r'
   ```
   **Impact:** This key is used for cryptographic signing of sessions, CSRF tokens, and password reset tokens. Exposure enables session hijacking, CSRF bypass, and token forgery. The `django-insecure-` prefix indicates this is a development key that should never be used in production.

3. **Permissive ALLOWED_HOSTS (Line 18):**
   ```python
   ALLOWED_HOSTS = ['0.0.0.0', 'localhost']
   ```
   **Impact:** While restrictive, this configuration only allows localhost access. However, in a misconfigured reverse proxy setup, Host header injection vulnerabilities could still occur.

**Defensive Mechanisms Assessment:**

- **Present:** Basic Django middleware stack with CSRF, clickjacking protection, and session management
- **Absent:** Rate limiting, input validation, WAF, intrusion detection, security monitoring, comprehensive logging, DDoS protection, IP allowlisting
- **Critical Gap:** No defense against the SSTI vulnerability since it occurs at template compilation time, before any security middleware can inspect or sanitize the output

---

## 3. Authentication & Authorization Deep Dive

### Authentication Mechanisms

**Installed Authentication Apps** (File: `/app/webapp/settings.py` lines 23-31):
```python
INSTALLED_APPS = [
    'django.contrib.admin',      # Django Admin interface
    'django.contrib.auth',       # Authentication framework
    'django.contrib.contenttypes',
    'django.contrib.sessions',   # Session-based auth
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'webapp',
]
```

**Authentication Configuration:**
- **Backend:** Django's default `ModelBackend` (database-backed authentication)
- **Method:** Session-based authentication using cookies
- **Scope:** Only used for Django admin interface at `/admin/`
- **Custom Authentication:** None implemented

**CRITICAL FINDING:** The application has **NO custom authentication endpoints**. There are no login, logout, registration, password reset, or token refresh endpoints exposed. Authentication is exclusively used for Django's built-in admin interface.

### Authentication API Endpoints

**Complete Endpoint Inventory** (File: `/app/webapp/urls.py` lines 5-9):

```python
urlpatterns = [
    path('admin/', admin.site.urls),  # Line 6 - AUTHENTICATED (Django admin)
    path('greet/', greet),             # Line 7 - UNAUTHENTICATED
    path('', index),                   # Line 8 - UNAUTHENTICATED
]
```

**Authentication Endpoint Analysis:**

1. **`/admin/`** (Django Admin Interface)
   - **Authentication Required:** Yes (Django session-based)
   - **Authorization:** Staff/superuser status required
   - **Login URL:** `/admin/login/` (Django default)
   - **Methods:** GET (form display), POST (credential submission)
   - **Protection:** CSRF token required for POST
   - **Vulnerability:** No rate limiting - unlimited brute force attempts possible

2. **`/` (Index Page)**
   - **Authentication Required:** No
   - **Authorization:** None
   - **Purpose:** Displays HTML form for name input
   - **File:** `/app/webapp/views.py` lines 16-17

3. **`/greet/` (Greeting Endpoint - VULNERABLE)**
   - **Authentication Required:** No
   - **Authorization:** None
   - **Purpose:** Server-side template rendering with user input
   - **File:** `/app/webapp/views.py` lines 7-14
   - **CRITICAL:** Contains SSTI vulnerability with FLAG exposure

**Missing Authentication Endpoints:**
- No `/login/`, `/logout/`, `/register/`, `/password-reset/`, `/token-refresh/`, `/verify-email/`, `/mfa-setup/`
- No custom authentication flows
- No API token endpoints
- No OAuth/SSO callback handlers

### Session Management and Token Security

**Session Configuration Analysis** (File: `/app/webapp/settings.py`):

**CRITICAL ISSUE:** No explicit session security configurations present. The application relies on Django 3.2 defaults:

```python
# Implicit defaults (NOT explicitly configured):
SESSION_ENGINE = 'django.contrib.sessions.backends.db'  # Database-backed sessions
SESSION_COOKIE_NAME = 'sessionid'
SESSION_COOKIE_AGE = 1209600                            # 2 weeks
SESSION_COOKIE_HTTPONLY = True                          # Good - JS cannot access
SESSION_COOKIE_SECURE = False                           # CRITICAL - No HTTPS requirement
SESSION_COOKIE_SAMESITE = 'Lax'                        # Moderate CSRF protection
SESSION_EXPIRE_AT_BROWSER_CLOSE = False                # Sessions persist
SESSION_SAVE_EVERY_REQUEST = False
```

**Session Cookie Flag Configuration - EXACT LOCATION:**

**CRITICAL FINDING:** Session cookie security flags are **NOT explicitly configured** in the codebase. Django uses the following defaults:

- **`HttpOnly` flag:** Defaults to `True` in Django 3.2 (good - prevents JavaScript access)
- **`Secure` flag:** Defaults to `False` (CRITICAL - cookies sent over HTTP)
- **`SameSite` flag:** Defaults to `'Lax'` in Django 3.2 (moderate protection)

**File Location:** These settings would be configured in `/app/webapp/settings.py` but are **ABSENT** from the codebase. To properly secure session cookies, the following lines should be added:

```python
# File: /app/webapp/settings.py (MISSING - should be added)
SESSION_COOKIE_SECURE = True        # Require HTTPS
SESSION_COOKIE_HTTPONLY = True      # Already default in Django 3.2
SESSION_COOKIE_SAMESITE = 'Strict'  # Stricter CSRF protection
```

**Security Implications:**
- Sessions transmitted over unencrypted HTTP (man-in-the-middle vulnerability)
- Network sniffing can capture sessionid cookies
- Session hijacking possible on unsecured networks
- Extended session lifetime (2 weeks) increases attack window

**Session Storage Backend:**
- **Engine:** Database-backed (`django.contrib.sessions.backends.db`)
- **Storage:** SQLite database at `/app/db.sqlite3`
- **Encryption:** None - session data signed but not encrypted
- **Access Control:** File system permissions only (weak in container environments)
- **Risk:** Physical access to SQLite file exposes all session data

### Authorization Model and Potential Bypass Scenarios

**Authorization Analysis** (File: `/app/webapp/views.py`):

```python
def greet(request):                                    # Line 7 - NO AUTHORIZATION
    engine = engines["django"]
    template = engine.from_string("<html><body><h1>Hello, "+request.GET.get("name")+"</h1></body></html>")
    flag = open('/flag.txt').read()                    # Line 10 - NO ACCESS CONTROL
    context = {
        'FLAG': flag
    }
    return HttpResponse(template.render(context, request))

def index(request):                                    # Line 16 - NO AUTHORIZATION
    return render(request, 'index.html')
```

**CRITICAL AUTHORIZATION FAILURES:**

1. **Zero Access Controls on Public Endpoints:**
   - No `@login_required` decorators
   - No `@permission_required` decorators
   - No `@user_passes_test` decorators
   - No custom authorization checks

2. **Sensitive Data Exposed Without Authorization (Lines 10-13):**
   - FLAG file read without any authentication check
   - FLAG loaded into template context for **EVERY request** to `/greet/`
   - No conditional access based on user role or permission
   - **Bypass Scenario:** Not applicable - there's no authorization to bypass; data is universally accessible

3. **No Role-Based Access Control (RBAC):**
   - No custom user roles defined
   - No permission models beyond Django's built-in admin permissions
   - No object-level permissions
   - No row-level security

4. **Django Admin Authorization:**
   - Uses Django's built-in permission system
   - Requires `is_staff` or `is_superuser` flag
   - No custom admin models registered (no `admin.py` file found)
   - Default Django admin security applies

**Potential Bypass Scenarios:**

1. **SSTI Bypass (Actual Vulnerability):**
   - The application loads FLAG into template context
   - SSTI vulnerability allows direct access via `{{FLAG}}` template syntax
   - No authorization mechanism can prevent this since vulnerability is pre-auth

2. **Session Fixation (Theoretical):**
   - Django protects against this by default via `CSRF_COOKIE_HTTPONLY`
   - However, session cookies sent over HTTP are vulnerable to hijacking
   - No explicit session regeneration on privilege escalation

3. **Admin Brute Force (No Rate Limiting):**
   - Unlimited login attempts at `/admin/login/`
   - No account lockout mechanism
   - No CAPTCHA or progressive delays
   - Weak passwords could be brute-forced

### Multi-tenancy Security Implementation

**FINDING:** Not applicable - this is a single-tenant application with no multi-tenancy architecture.

### SSO/OAuth/OIDC Flows

**FINDING:** No SSO, OAuth, or OIDC implementations detected.

**Analysis:**
- No `AUTHENTICATION_BACKENDS` configuration beyond Django defaults
- No OAuth client libraries in dependencies
- No callback endpoints (`/oauth/callback`, `/saml/acs`, etc.)
- No social authentication (django-allauth, python-social-auth not installed)
- No OIDC discovery endpoints
- No JWKS fetchers or JWT validation

**State and Nonce Parameter Validation:** Not applicable - no OAuth/OIDC flows present.

---

## 4. Data Security & Storage

### Database Security

**Database Configuration** (File: `/app/webapp/settings.py` lines 67-72):

```python
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}
```

**Security Assessment:**

✅ **Advantages:**
- No network-exposed database service (reduces attack surface)
- No database credentials to steal (file-based authentication)
- Suitable for single-instance, low-traffic applications
- Contained within Docker container filesystem

❌ **Critical Security Deficiencies:**

1. **No Encryption at Rest:**
   - SQLite database stored as plain text file
   - No SQLCipher or encryption extension configured
   - Anyone with filesystem access can read entire database
   - Password hashes and session data readable if container compromised

2. **No Connection Encryption:**
   - Not applicable (SQLite is in-process, not network-based)
   - However, this also means no network-level access controls

3. **Weak Access Controls:**
   - Only OS-level file permissions protect database
   - In Docker containers, file permissions are often relaxed
   - No database user/role system (SQLite limitation)
   - No audit logging of database access

4. **No Database Backups:**
   - No backup mechanism observed in codebase
   - Database is ephemeral in default Docker setup (lost on container removal)
   - No disaster recovery plan

5. **No Query Monitoring:**
   - No query logging configured
   - No slow query analysis
   - No SQL injection detection (though Django ORM prevents this by default)

**Password Storage:**
Django uses PBKDF2-SHA256 by default for password hashing (adequate), but the application has no explicit `PASSWORD_HASHERS` configuration. Default Django 3.2 settings apply:
- Algorithm: PBKDF2-SHA256
- Iterations: 260,000
- This is industry-standard but not explicitly hardened

### Data Flow Security

**Sensitive Data: FLAG File**

**Complete Data Flow Trace:**

1. **Source: Build-Time Injection**
   - File: `/app/Dockerfile` lines 14-15
   ```dockerfile
   ARG FLAG
   RUN echo -n $FLAG > /flag.txt
   ```
   - FLAG passed as Docker build argument
   - Written to container filesystem at `/flag.txt`
   - **Vulnerability:** Visible in `docker history` output
   - **Protection:** None

2. **Storage: Container Filesystem**
   - Location: `/flag.txt` (container root)
   - Permissions: Default (likely world-readable)
   - Encryption: None
   - Access Control: File system permissions only
   - **Vulnerability:** Any process in container can read file

3. **Application Read: Unprotected File Access**
   - File: `/app/webapp/views.py` line 10
   ```python
   flag = open('/flag.txt').read()
   ```
   - Occurs on **EVERY request** to `/greet/` endpoint
   - No caching (file read on each request - performance and security issue)
   - No error handling (no try/except block)
   - File handle not properly closed (resource leak)
   - No access control checks before file read

4. **Memory Exposure: Template Context**
   - File: `/app/webapp/views.py` lines 11-13
   ```python
   context = {
       'FLAG': flag
   }
   ```
   - FLAG stored in memory as dictionary value
   - Passed to Django template rendering engine
   - Available to all template expressions and filters
   - **CRITICAL:** Accessible via SSTI vulnerability
   - No secure memory handling or wiping

5. **Network Transmission: HTTP Response**
   - File: `/app/webapp/views.py` line 14
   ```python
   return HttpResponse(template.render(context, request))
   ```
   - FLAG in response if accessed via SSTI (e.g., `?name={{FLAG}}`)
   - Transmitted over unencrypted HTTP
   - No TLS/SSL protection
   - Vulnerable to network sniffing and MITM attacks

**Trust Boundaries Crossed:**
- Filesystem → Application Memory (no encryption)
- Application Memory → Template Engine (no sanitization)
- Template Engine → HTTP Response (no encryption in transit)
- Build Argument → Container Image (persists in all layers)

**Data Protection Mechanisms:** **NONE** - No encryption, access control, or sanitization at any layer.

### Multi-tenant Data Isolation

**FINDING:** Not applicable - single-tenant application with no multi-tenancy architecture.

---

## 5. Attack Surface Analysis

### External Entry Points

**Network-Accessible Endpoints:**

| Endpoint | HTTP Method | Auth Required | Input Source | Vulnerability | Severity |
|----------|-------------|---------------|--------------|---------------|----------|
| `/` | Any (no restriction) | No | None | Low risk - static template | Low |
| `/greet/` | Any (no restriction) | No | GET param `name` | **SSTI + FLAG Exposure** | **CRITICAL** |
| `/admin/` | GET, POST | Yes (session) | Form data | Brute force (no rate limit) | Medium |

**Detailed Entry Point Analysis:**

1. **Root Index Endpoint: `/`**
   - **File:** `/app/webapp/urls.py` line 8 → `/app/webapp/views.py` lines 16-17
   - **View Function:**
     ```python
     def index(request):
         return render(request, 'index.html')
     ```
   - **HTTP Methods:** All methods accepted (no restriction)
   - **Authentication:** None required
   - **Input Validation:** Not applicable (no user input processed)
   - **CSRF Protection:** Enabled (but form uses GET method, so not applied)
   - **Template:** `/app/templates/index.html` (static HTML form)
   - **Security Implications:** Minimal risk - renders static page with form. Form submits to `/greet/` via GET method with `name` parameter.
   - **Attack Surface:** Low - no dynamic content or user input processing

2. **Greeting Endpoint: `/greet/` - CRITICAL VULNERABILITY**
   - **File:** `/app/webapp/urls.py` line 7 → `/app/webapp/views.py` lines 7-14
   - **View Function:**
     ```python
     def greet(request):
         engine = engines["django"]
         template = engine.from_string("<html><body><h1>Hello, "+request.GET.get("name")+"</h1></body></html>")
         flag = open('/flag.txt').read()
         context = {
             'FLAG': flag
         }
         return HttpResponse(template.render(context, request))
     ```
   - **HTTP Methods:** All methods accepted (GET, POST, PUT, DELETE - no restriction)
   - **Authentication:** None required
   - **Input Source:** `request.GET.get("name")` - URL query parameter
   - **Input Validation:** **NONE** - no length limits, character whitelisting, or sanitization
   - **CSRF Protection:** Enabled but ineffective (GET requests bypass CSRF)
   - **CRITICAL VULNERABILITIES:**
     - **Server-Side Template Injection (SSTI):** User input concatenated directly into template string at line 9
     - **Information Disclosure:** FLAG file contents loaded into template context (lines 10-13)
     - **Resource Leak:** File handle not closed properly (line 10)
   - **Exploitation:**
     ```
     GET /greet/?name={{FLAG}}
     Response: <html><body><h1>Hello, flag{fa1d018a-9a02-4ccb-a2d4-98ec79c62603}</h1></body></html>
     ```
   - **Attack Surface:** CRITICAL - Unauthenticated SSTI with direct access to sensitive data

3. **Django Admin Interface: `/admin/`**
   - **File:** `/app/webapp/urls.py` line 6 → Django's built-in admin
   - **HTTP Methods:** GET (form display), POST (authentication)
   - **Authentication:** Required (Django session-based with username/password)
   - **Authorization:** Staff or superuser status required
   - **CSRF Protection:** Enabled for all state-changing operations
   - **Password Policy:** Configured (lines 78-91 of settings.py) with validators:
     - UserAttributeSimilarityValidator
     - MinimumLengthValidator (default 8 characters)
     - CommonPasswordValidator
     - NumericPasswordValidator
   - **Security Implications:**
     - **No Rate Limiting:** Unlimited brute force attempts possible
     - **No CAPTCHA:** No challenge-response protection
     - **No Account Lockout:** No automatic disabling after failed attempts
     - **Default Admin Path:** Well-known URL (not obscured)
     - **No 2FA/MFA:** Single-factor authentication only
   - **Attack Surface:** Medium - Protected by authentication but vulnerable to brute force

### Internal Service Communication

**FINDING:** Not applicable - this is a monolithic application with no internal service-to-service communication, microservices, or inter-process communication beyond the single Django application process.

**Analysis:**
- No message queues (no RabbitMQ, Redis, Kafka)
- No service mesh or API gateway
- No internal APIs or gRPC services
- No background workers (no Celery, RQ)
- All processing occurs within the single Django application process

### Input Validation Patterns

**Global Input Validation Analysis:**

**CRITICAL FINDING:** The application has **NO input validation** on the vulnerable `/greet/` endpoint.

**File:** `/app/webapp/views.py` line 9
```python
template = engine.from_string("<html><body><h1>Hello, "+request.GET.get("name")+"</h1></body></html>")
```

**Validation Gaps:**

1. **No Length Limits:**
   - `request.GET.get("name")` accepts unlimited input length
   - No `max_length` validation
   - Potential for DoS via extremely long strings

2. **No Character Whitelisting:**
   - No regex validation
   - No character set restrictions
   - Accepts special characters: `{`, `}`, `<`, `>`, `"`, `'`, etc.
   - Enables SSTI exploitation via `{{` and `}}` template syntax

3. **No Sanitization:**
   - No HTML escaping (though irrelevant since injection occurs at template compilation)
   - No template syntax filtering
   - No dangerous character removal
   - Django's `mark_safe` imported but never used (line 4 of views.py)

4. **No Type Validation:**
   - No type checking (accepts any string)
   - No format validation (email, phone, etc.)

**Django Form Validation:**
- No Django Form classes defined (`forms.py` does not exist)
- No model forms or form validators
- Raw request parameter access without validation

**CSRF Validation:**
- Enabled globally via middleware (line 37 of settings.py)
- However, `/greet/` uses GET method, so CSRF protection does not apply
- CSRF tokens only protect POST/PUT/PATCH/DELETE requests

**Middleware-Based Validation:**
- No custom validation middleware
- No rate limiting middleware
- No input sanitization middleware

**Security Implications:**
The complete absence of input validation on network-accessible endpoints is the root cause of the SSTI vulnerability. Any user-controlled input should be validated, sanitized, and never concatenated directly into code or templates.

### Background Processing

**FINDING:** No background processing, async jobs, or task queues detected.

**Analysis:**
- No Celery configuration or `celery.py` file
- No Redis or RabbitMQ dependencies
- No task decorators (`@task`, `@periodic_task`)
- No async views (Django 3.2 supports `async def` but none implemented)
- No scheduled jobs (cron, APScheduler, django-crontab)
- All request processing is synchronous and inline

**Security Implication:**
- Reduced attack surface (no task queue poisoning, no job injection)
- All operations traceable to direct HTTP requests
- No asynchronous privilege escalation vectors

---

## 6. Infrastructure & Operational Security

### Secrets Management

**CRITICAL SECURITY FAILURES:**

1. **Hardcoded Django SECRET_KEY**
   - **File:** `/app/webapp/settings.py` line 13
   ```python
   SECRET_KEY = 'django-insecure-+@i)-n58!b8#v^)-+s!8$#l@7z%b^!52rrn4kl+^9-@riokc5r'
   ```
   - **Exposure:** Committed to version control (visible in git history)
   - **Impact:** Used for cryptographic signing of sessions, CSRF tokens, password reset tokens
   - **Consequences:** Session hijacking, CSRF bypass, token forgery if key is compromised
   - **Django Warning:** The `django-insecure-` prefix explicitly indicates this is a development key unsuitable for production

2. **FLAG in Environment File**
   - **File:** `/.env` line 1
   ```env
   FLAG="flag{fa1d018a-9a02-4ccb-a2d4-98ec79c62603}"
   ```
   - **Exposure:** Committed to git repository
   - **Impact:** Sensitive flag value permanently in version control history
   - **Visibility:** Anyone with repository access (including historical commits) can read flag

3. **FLAG as Docker Build Argument**
   - **File:** `/app/Dockerfile` lines 14-15
   ```dockerfile
   ARG FLAG
   RUN echo -n $FLAG > /flag.txt
   ```
   - **Exposure:** Build arguments visible in Docker image history
   - **Extraction:** `docker history <image_id>` reveals FLAG value
   - **Persistence:** FLAG embedded in all image layers
   - **Impact:** Anyone with image access can extract flag without running container

**Secret Rotation:**
- **Status:** No rotation mechanism exists
- **SECRET_KEY:** Hardcoded - requires code change to rotate
- **FLAG:** Baked into image - requires rebuild to change
- **Impact:** Compromised secrets cannot be quickly invalidated

**Best Practice Violations:**
- No environment variable usage for secrets (`.env` file not loaded by application)
- No secret management service (no Vault, AWS Secrets Manager, GCP Secret Manager)
- No `.gitignore` entry for `.env` file (secrets committed to repo)
- No encryption of secrets at rest

### Configuration Security

**Environment Separation:**

**CRITICAL MISCONFIGURATION:** The application uses a single configuration file with no environment-based overrides.

**File:** `/app/webapp/settings.py`

**Production-Unsafe Settings:**

1. **DEBUG Mode Enabled (Line 16):**
   ```python
   DEBUG = True
   ```
   - **Should be:** `DEBUG = os.environ.get('DEBUG', 'False') == 'True'`
   - **Impact:** Exposes detailed error pages with:
     - Full stack traces revealing source code
     - Local variable values (including FLAG)
     - Settings configuration (including SECRET_KEY)
     - Environment variables
     - Database queries with parameters
     - Installed packages and versions

2. **No Environment-Based Configuration:**
   - No use of `os.environ.get()` for sensitive settings
   - No django-environ or python-decouple integration
   - No separate `settings/development.py` and `settings/production.py`
   - Single `settings.py` used for all environments

3. **ALLOWED_HOSTS Configuration (Line 18):**
   ```python
   ALLOWED_HOSTS = ['0.0.0.0', 'localhost']
   ```
   - Restrictive to localhost only (good for dev, bad for production)
   - No domain names configured
   - Would need to be updated for production deployment

**Security Headers Configuration:**

**File:** `/app/webapp/settings.py`

**CRITICAL FINDING:** No infrastructure-level security header configurations detected in application code. Security headers would typically be configured in:
- Nginx configuration (not present - no reverse proxy)
- Kubernetes Ingress annotations (no Kubernetes manifests found)
- CDN settings (no CDN integration detected)

**Application-Level Header Configuration (Django):**
The following security header settings are **MISSING** from `settings.py`:

```python
# MISSING CONFIGURATIONS:
SECURE_HSTS_SECONDS = 0                    # No HTTP Strict Transport Security
SECURE_HSTS_INCLUDE_SUBDOMAINS = False     # HSTS not applied to subdomains
SECURE_HSTS_PRELOAD = False                # Not eligible for browser HSTS preload list
SECURE_CONTENT_TYPE_NOSNIFF = True         # Default in Django 3.2 (good)
SECURE_BROWSER_XSS_FILTER = False          # No X-XSS-Protection header
SECURE_SSL_REDIRECT = False                # No automatic HTTPS redirect
X_FRAME_OPTIONS = 'DENY'                   # Default via XFrameOptionsMiddleware (good)
# Content-Security-Policy: Not configured
# Referrer-Policy: Not configured
# Permissions-Policy: Not configured
```

**Infrastructure Configuration Search:**

I searched for infrastructure configuration files that would define security headers:

1. **Nginx Configuration:** Not found (no `nginx.conf`, `nginx.vh.default.conf`, etc.)
2. **Kubernetes Ingress:** Not found (no `ingress.yaml` or similar manifests)
3. **Docker Compose Annotations:** None present in `docker-compose.yml`
4. **CDN Configuration:** No CDN integration detected

**Security Implication:**
The application relies entirely on Django's default security middleware with no custom header configurations. This results in missing critical security headers like:
- `Strict-Transport-Security` (HSTS) - **Absent:** No HTTPS enforcement
- `Content-Security-Policy` (CSP) - **Absent:** No XSS mitigation
- `Referrer-Policy` - **Absent:** Full referrer leakage
- `Permissions-Policy` - **Absent:** No feature restriction

### External Dependencies

**Dependency Analysis:**

**File:** `/app/requirements.txt`
```
Django==3.2
```

**Security Assessment:**

1. **Minimal Dependencies:**
   - Only one explicit dependency
   - Reduces third-party supply chain risk
   - However, Django 3.2 has transitive dependencies (not pinned)

2. **Django 3.2 Security Status:**
   - Released: April 2021
   - Extended support until: April 2024 (approaching end of life)
   - Known CVEs: Multiple security patches released for 3.2.x series
   - Current version at time of assessment: Django 3.2.25 (application uses 3.2, possibly outdated patch level)

3. **Missing Security Dependencies:**
   - No `django-ratelimit` (rate limiting)
   - No `django-defender` (brute force protection)
   - No `django-cors-headers` (CORS management)
   - No `gunicorn` or `uwsgi` (production WSGI server)
   - No `django-extensions` (security helpers)
   - No `django-csp` (Content Security Policy)

4. **No Dependency Pinning:**
   - No `requirements.lock` or `Pipfile.lock`
   - No hash verification (`pip install --require-hashes`)
   - Version not fully pinned (should be `Django==3.2.X` with specific patch version)

**External Services:**

**FINDING:** No external service integrations detected.
- No third-party API calls (no requests library usage)
- No payment gateways
- No email services
- No SMS providers
- No cloud storage (S3, GCS)
- No analytics or monitoring services
- No authentication providers (Auth0, Okta)

**Docker Base Image:**

**File:** `/app/Dockerfile` line 1
```dockerfile
FROM python:3.9-slim
```

**Security Considerations:**
- Uses official Python Docker image (good)
- `slim` variant reduces attack surface (good)
- No version pinning with SHA256 digest (should use `@sha256:...`)
- Base image vulnerabilities depend on upstream updates

### Monitoring & Logging

**Logging Configuration:**

**CRITICAL FINDING:** No custom logging configuration detected in the application.

**File:** `/app/webapp/settings.py`
- No `LOGGING` dictionary configuration
- Django uses default console logging only
- All logs output to stdout/stderr (captured by Docker)

**Default Django 3.2 Logging Behavior:**
- Log level: DEBUG (when DEBUG=True)
- Output: Console (stdout/stderr)
- No file persistence
- No log rotation
- No structured logging (JSON format)

**Security Event Logging Gaps:**

1. **No Authentication Event Logging:**
   - No logging of successful logins
   - No logging of failed login attempts
   - No brute force detection
   - No session creation/destruction logs

2. **No Authorization Event Logging:**
   - No access denied logs
   - No permission check logs
   - No privilege escalation attempts logged

3. **No Input Validation Logs:**
   - No logging of malformed requests
   - No SSTI attempt detection
   - No input sanitization logs

4. **No Security Event Logs:**
   - No CSRF token validation failures
   - No suspicious request pattern detection
   - No rate limit violations (no rate limiting exists)

5. **Sensitive Data in Logs (Risk):**
   - DEBUG=True causes full request logging (including query parameters)
   - Exception logging includes local variables (could expose FLAG)
   - No log sanitization or redaction
   - **File:** `/app/webapp/views.py` line 10 - If file read fails, exception could log FLAG variable

**Log Storage and Access:**

- **Storage:** Docker container stdout/stderr
- **Access:** `docker logs <container_id>` command
- **Retention:** Logs persist until container is removed
- **Encryption:** None (plain text logs)
- **Access Control:** Docker daemon permissions only
- **Aggregation:** None (no centralized logging)

**Monitoring:**

**Docker Health Check** (File: `/docker-compose.yml` lines 7-11):
```yaml
healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:8000"]
  timeout: 1s
  retries: 5
  interval: 10s
```

**Analysis:**
- Basic HTTP health check implemented
- Only checks if application responds on port 8000
- No application-level health checks (database, disk space, memory)
- No security monitoring or intrusion detection
- No performance monitoring (APM)
- No error rate tracking
- No alerting system

**Missing Monitoring:**
- No application performance monitoring (APM)
- No security information and event management (SIEM)
- No intrusion detection system (IDS)
- No file integrity monitoring (FIM)
- No network traffic analysis
- No vulnerability scanning

---

## 7. Overall Codebase Indexing

The application follows a minimalist Django project structure with an exceptionally small codebase footprint. The entire application consists of **142 lines of Python code** across just three functional files (`settings.py`, `urls.py`, and `views.py`), making it one of the most compact web applications typically encountered in security assessments.

The project is organized using Django's standard single-application layout, with all custom logic contained within the `webapp/` package directory. Unlike more complex Django projects with multiple apps (e.g., `users/`, `api/`, `core/`), this codebase maintains a flat structure with minimal abstraction. The absence of models (`models.py`), forms (`forms.py`), serializers, or custom management commands indicates this is a pure presentation-layer application with no database interactions beyond Django's internal authentication system.

The `templates/` directory at the application root contains only two HTML templates: `index.html` (the landing page with a simple form) and `greet.html` (which appears unused since the greeting endpoint dynamically generates HTML via `engine.from_string()` rather than rendering a template file). This architectural decision to bypass Django's template loader and directly compile user-provided strings is the root cause of the SSTI vulnerability.

Notably absent from the codebase are several components commonly found in Django projects: no `static/` directory for CSS/JavaScript (indicating no client-side code), no `media/` directory for user uploads, no `migrations/` directory (suggesting no custom database models), no `tests/` directory (no automated testing), and no additional Python packages beyond the single Django dependency. The lack of a `requirements-dev.txt`, `Pipfile`, or `poetry.lock` suggests the project uses pip directly without modern dependency management tools.

The build orchestration is handled through a simple Docker setup with a multi-line `Dockerfile` that installs curl (for health checks), embeds the FLAG value at build time, and runs the Django development server directly without a production WSGI server like Gunicorn. The `docker-compose.yml` configuration is equally minimal, exposing port 8000 with a basic HTTP health check but no volume mounts, environment variable injection, or network isolation.

From a security perspective, this minimalist structure is a double-edged sword: while the small attack surface reduces the number of potential vulnerability locations, the lack of security-focused libraries, input validation frameworks, logging infrastructure, and defensive coding practices means that the few entry points present are inadequately protected. The codebase exhibits characteristics of a training exercise or proof-of-concept rather than a production application, with intentional vulnerabilities and configurations that prioritize simplicity over security.

---

## 8. Critical File Paths

### Configuration
- `/app/webapp/settings.py` - Django configuration with DEBUG=True, hardcoded SECRET_KEY, missing security headers
- `/app/Dockerfile` - Container build file with FLAG embedded as build argument (lines 14-15)
- `/docker-compose.yml` - Service orchestration with port 8000 exposure and health check
- `/.env` - Environment file with FLAG value (committed to version control)
- `/app/requirements.txt` - Single dependency: Django==3.2

### Authentication & Authorization
- `/app/webapp/settings.py` (lines 33-41) - Middleware stack including AuthenticationMiddleware and CsrfViewMiddleware
- `/app/webapp/settings.py` (lines 78-91) - Password validators configuration
- `/app/webapp/settings.py` (lines 23-31) - Installed apps including django.contrib.auth and django.contrib.sessions
- `/app/webapp/urls.py` (line 6) - Django admin authentication endpoint

### API & Routing
- `/app/webapp/urls.py` - URL routing configuration (3 routes: /, /greet/, /admin/)
- `/app/webapp/views.py` (lines 7-14) - greet() view with SSTI vulnerability and FLAG exposure
- `/app/webapp/views.py` (lines 16-17) - index() view rendering landing page
- `/app/templates/index.html` - HTML form submitting to /greet/ via GET method
- `/app/templates/greet.html` - Unused template file

### Data Models & DB Interaction
- `/app/webapp/settings.py` (lines 67-72) - SQLite database configuration (db.sqlite3)
- No models.py file exists - application uses Django's built-in models only
- No migrations/ directory - no custom database migrations

### Dependency Manifests
- `/app/requirements.txt` - Python dependencies (only Django==3.2)

### Sensitive Data & Secrets Handling
- `/app/webapp/views.py` (line 10) - FLAG file read: `flag = open('/flag.txt').read()`
- `/app/webapp/views.py` (lines 11-13) - FLAG exposed in template context
- `/app/Dockerfile` (lines 14-15) - FLAG written to /flag.txt at build time
- `/.env` (line 1) - FLAG value in plain text
- `/app/webapp/settings.py` (line 13) - Hardcoded SECRET_KEY

### Middleware & Input Validation
- `/app/webapp/settings.py` (lines 33-41) - Middleware stack (SecurityMiddleware, CsrfViewMiddleware, etc.)
- `/app/webapp/views.py` (line 9) - SSTI vulnerability: user input concatenated into template string
- No forms.py or input validation files exist

### Logging & Monitoring
- No logging configuration file - uses Django defaults
- `/docker-compose.yml` (lines 7-11) - Health check configuration using curl

### Infrastructure & Deployment
- `/app/Dockerfile` - Multi-stage container build with python:3.9-slim base
- `/docker-compose.yml` - Docker Compose service definition
- `/app/wsgi.py` - WSGI application entry point
- `/app/manage.py` - Django management CLI (not network-accessible)
- `/app/Makefile` - Build system (delegates to parent common.mk not in repo)

---

## 9. XSS Sinks and Render Contexts

### Executive Summary

This Django application has **NO traditional client-side XSS sinks** (no JavaScript, no DOM manipulation, no innerHTML usage). However, it contains a **CRITICAL Server-Side Template Injection (SSTI)** vulnerability that is more severe than typical XSS, allowing server-side code execution and direct access to sensitive data.

### XSS Sink Analysis by Render Context

#### HTML Body Context
**Status:** ❌ NO CLIENT-SIDE XSS SINKS FOUND

**Analysis:**
- No `innerHTML` property usage
- No `outerHTML` property usage
- No `document.write()` or `document.writeln()` calls
- No `insertAdjacentHTML()` methods
- No `Range.createContextualFragment()` usage
- No jQuery or similar libraries (no `.html()`, `.append()`, `.prepend()`, etc.)

**Reason:** The application contains no client-side JavaScript files. All HTML is rendered server-side via Django templates.

#### HTML Attribute Context
**Status:** ❌ NO ATTRIBUTE-BASED XSS SINKS FOUND

**Analysis:**
- No dynamic event handlers (onclick, onerror, onmouseover, onload, onfocus)
- No dynamic URL-based attributes (href, src, formaction, action, background, data)
- No dynamic style attributes
- No iframe srcdoc manipulation

**Template Analysis** (File: `/app/templates/index.html`):
```html
<form action="/greet/" method="get">
    <label for="name">Enter your name:</label>
    <input type="text" id="name" name="name">
    <button type="submit">Greet</button>
</form>
```
- All attributes are static (hardcoded)
- No template variables or user input in attributes

#### JavaScript Context
**Status:** ❌ NO JAVASCRIPT EXECUTION SINKS FOUND

**Analysis:**
- No `eval()` calls
- No `Function()` constructor usage
- No `setTimeout()` or `setInterval()` with string arguments
- No dynamic `<script>` tag content generation
- **Reason:** Application contains no JavaScript files (`static/` directory does not exist)

#### CSS Context
**Status:** ❌ NO CSS INJECTION SINKS FOUND

**Analysis:**
- No `element.style` property manipulation
- No dynamic `<style>` tag content generation
- No client-side styling logic

#### URL Context
**Status:** ❌ NO URL MANIPULATION SINKS FOUND

**Analysis:**
- No `location` or `window.location` manipulation
- No `location.href`, `location.replace()`, or `location.assign()` calls
- No `window.open()` usage
- No `history.pushState()` or `history.replaceState()` calls
- No `URL.createObjectURL()` usage
- No jQuery selector injection (no jQuery present)

### Server-Side Template Injection (SSTI) - CRITICAL VULNERABILITY

**Vulnerability Type:** Server-Side Template Injection (SSTI) - More severe than XSS  
**Severity:** CRITICAL  
**CVSS Score:** 9.8 (Critical)

**Location:**
- **File:** `/app/webapp/views.py`
- **Line:** 9
- **Endpoint:** `/greet/`
- **Method:** GET (any HTTP method accepted)

**Vulnerable Code:**
```python
def greet(request):                                    # Line 7
    engine = engines["django"]                         # Line 8
    template = engine.from_string("<html><body><h1>Hello, "+request.GET.get("name")+"</h1></body></html>")  # Line 9 - VULNERABLE
    flag = open('/flag.txt').read()                    # Line 10
    context = {
        'FLAG': flag                                    # Line 11-13
    }
    return HttpResponse(template.render(context, request))  # Line 14
```

**Vulnerability Analysis:**

1. **Injection Point:** Line 9 - User input from `request.GET.get("name")` is concatenated directly into a template string
2. **Render Context:** Server-side Django template compilation (occurs before rendering)
3. **User-Controlled Input:** GET parameter `name` from URL query string
4. **Template Engine:** Django template engine (`engines["django"]`)
5. **Dynamic Compilation:** `engine.from_string()` compiles the user-provided string as template code

**Why This Is More Severe Than XSS:**

- **Server-Side Execution:** Code executes on the server, not in the browser
- **Full Template Access:** Attacker has access to all template context variables
- **FLAG Exposure:** The FLAG variable containing `/flag.txt` contents is in the template context
- **No Auto-Escaping:** Django's auto-escaping is irrelevant since injection occurs at compilation time
- **Potential RCE:** Django templates support filters and tags that can lead to arbitrary Python code execution

**Exploitation Examples:**

1. **Direct FLAG Extraction:**
   ```
   GET /greet/?name={{FLAG}}
   Response: <html><body><h1>Hello, flag{fa1d018a-9a02-4ccb-a2d4-98ec79c62603}</h1></body></html>
   ```

2. **Template Variable Enumeration:**
   ```
   GET /greet/?name={{request}}
   Response: Exposes request object details
   ```

3. **Settings Access:**
   ```
   GET /greet/?name={{request.META}}
   Response: Exposes environment variables and server configuration
   ```

4. **Potential RCE (Advanced):**
   Django templates have limited execution capabilities, but attackers can potentially:
   - Access `settings.SECRET_KEY` via template context
   - Enumerate installed apps and middleware
   - Potentially exploit custom template tags/filters if they exist

**Security Implications:**

- **Confidentiality:** CRITICAL - Direct exposure of FLAG data
- **Integrity:** HIGH - Potential to manipulate application state via advanced SSTI techniques
- **Availability:** MEDIUM - Malformed templates could cause application errors
- **Authentication Bypass:** Not applicable - endpoint is unauthenticated
- **Authorization Bypass:** Not applicable - no authorization checks

**No Remediation Present:**

The code has no mitigations:
- No input validation or sanitization
- No character whitelisting (template syntax `{{` and `}}` allowed)
- No length limits on input
- No rate limiting to prevent exploitation
- No Web Application Firewall (WAF) to detect template injection patterns

**File:** `/app/webapp/views.py` line 4 imports `mark_safe` but never uses it:
```python
from django.utils.safestring import mark_safe  # Imported but unused
```

### Summary Table

| Sink Type | Count | Severity | Location | Exploitable |
|-----------|-------|----------|----------|-------------|
| **Server-Side Template Injection (SSTI)** | **1** | **CRITICAL** | `/app/webapp/views.py:9` | **YES** |
| Client-Side XSS (innerHTML, etc.) | 0 | N/A | N/A | N/A |
| Attribute-Based XSS | 0 | N/A | N/A | N/A |
| JavaScript Execution (eval, etc.) | 0 | N/A | N/A | N/A |
| CSS Injection | 0 | N/A | N/A | N/A |
| URL Manipulation | 0 | N/A | N/A | N/A |

### Recommendations

**IMMEDIATE ACTION REQUIRED:**

1. **Fix SSTI Vulnerability:**
   - Replace `engine.from_string()` with Django's template loader
   - Never concatenate user input into template strings
   - Use Django's template rendering with context variables:
   ```python
   def greet(request):
       name = request.GET.get("name", "Guest")
       context = {'name': name}
       return render(request, 'greet.html', context)
   ```

2. **Remove FLAG from Template Context:**
   - FLAG should never be accessible to templates
   - Implement proper access controls for sensitive data
   - Store secrets securely, not in filesystem or template context

3. **Add Input Validation:**
   - Validate and sanitize all user input
   - Implement character whitelisting for name parameter
   - Add length limits (e.g., max 50 characters)
   - Use Django Forms for structured validation

4. **Add Rate Limiting:**
   - Implement rate limiting to slow exploitation attempts
   - Use django-ratelimit or similar library

---

## 10. SSRF Sinks

### Executive Summary

After conducting a comprehensive SSRF vulnerability trace across the entire Django application codebase, **NO SSRF SINKS WERE IDENTIFIED** in any publicly facing web application components. The application makes no outbound HTTP requests, does not fetch URLs, and has no functionality that could be manipulated to force server-side requests to unintended destinations.

### Why No SSRF Sinks Exist

This Django application is a **self-contained, isolated web service** with the following characteristics:

1. **No HTTP Client Usage:** Despite HTTP client libraries being available in the Python environment (`requests`, `urllib3`, `httpx`, `aiohttp`), the application code never imports or uses any of them.

2. **No External Communication:** The application has no functionality requiring communication with external services, APIs, or URLs.

3. **No URL Processing:** The application does not accept URLs as input, fetch remote resources, or process user-provided network addresses.

4. **Minimal Functionality:** The application only:
   - Accepts user input via GET parameters
   - Renders templates
   - Reads a local flag file with a hardcoded path
   - Serves static HTML

### SSRF Sink Analysis by Category

#### HTTP(S) Clients
**Status:** ❌ NOT FOUND

**Libraries Checked:**
- `requests` library - NOT IMPORTED OR USED
- `urllib`, `urllib2`, `urllib3` - NOT IMPORTED OR USED
- `http.client` / `httplib` - NOT IMPORTED OR USED
- `httpx` - NOT IMPORTED OR USED
- `aiohttp` - NOT IMPORTED OR USED

**Analysis:**
All Python files were searched for HTTP client imports and usage. No HTTP GET/POST/PUT/DELETE requests found in any application code.

**Files Analyzed:**
- `/app/webapp/views.py` - No HTTP client usage
- `/app/webapp/settings.py` - No HTTP client configuration
- `/app/webapp/urls.py` - No HTTP client usage
- `/app/webapp/wsgi.py` - WSGI entry point only
- `/app/manage.py` - Django CLI only (not network-accessible)

#### Raw Sockets & Connect APIs
**Status:** ❌ NOT FOUND

**Analysis:**
- No `socket` module imports
- No `socket.connect()` calls
- No raw network connections in application code
- No custom TCP/UDP clients

#### URL Openers & File Includes
**Status:** ❌ NOT FOUND (No SSRF Risk)

**File Operation Found:**
- **File:** `/app/webapp/views.py` line 10
  ```python
  flag = open('/flag.txt').read()
  ```

**Security Assessment:**
- This `open()` call uses a **HARDCODED PATH** (`/flag.txt`)
- NO user input influences the file path
- NO URL-based file opening detected
- This is a local file read with no user control
- **NOT AN SSRF VECTOR** - file path is static

**No URL-Based File Opening:**
- No `urllib.urlopen()` usage
- No `urllib.request.urlopen()` usage
- No URL handling in file operations

#### Redirect & "Next URL" Handlers
**Status:** ❌ NOT FOUND

**Analysis:**
- No `HttpResponseRedirect` usage in views
- No `redirect()` function calls
- No URL validation or redirect functionality
- No "next" parameter handling for post-authentication redirects
- No Location header manipulation

**Files Checked:**
- All view functions in `/app/webapp/views.py`
- URL configuration in `/app/webapp/urls.py`

#### Headless Browsers & Render Engines
**Status:** ❌ NOT FOUND

**Libraries Checked:**
- Selenium - NOT FOUND
- Playwright - NOT FOUND
- Puppeteer - NOT FOUND
- Splash - NOT FOUND
- WebDriver - NOT FOUND

**Analysis:**
No browser automation libraries imported or configured.

#### Media Processors
**Status:** ❌ NOT FOUND

**Libraries Checked:**
- PIL/Pillow - NOT FOUND
- ImageMagick/Wand - NOT FOUND
- FFmpeg - NOT FOUND
- wkhtmltopdf - NOT FOUND
- ImageField/FileField - NOT FOUND

**Analysis:**
- No image processing with URL inputs
- No PDF generation functionality
- No media upload or processing endpoints
- No URL-based media loading

#### Webhook Testers & Callback Verifiers
**Status:** ❌ NOT FOUND

**Analysis:**
- No webhook handling functionality
- No callback URL verification endpoints
- No "ping my webhook" features
- No outbound notification systems

**Docker Health Check:**
The `docker-compose.yml` file (lines 7-11) contains a health check:
```yaml
healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:8000"]
  timeout: 1s
  retries: 5
  interval: 10s
```

**Assessment:** This is an **internal health check** performed by Docker, not part of the application's network-accessible attack surface. It is out of scope for SSRF analysis.

#### Link Preview & Unfurlers
**Status:** ❌ NOT FOUND

**Analysis:**
- No link preview generation
- No oEmbed endpoint fetchers
- No URL metadata extractors
- No social media card generators

#### SSO/OIDC Discovery & JWKS Fetchers
**Status:** ❌ NOT FOUND

**Analysis:**
- No OpenID Connect discovery endpoints
- No JWKS (JSON Web Key Set) fetchers
- No OAuth authorization server metadata fetching
- No SAML metadata retrievers

#### Importers & Data Loaders
**Status:** ❌ NOT FOUND

**Analysis:**
- No "import from URL" functionality
- No CSV/JSON/XML remote loaders
- No RSS/Atom feed readers
- No remote configuration file fetchers

#### Package/Plugin/Theme Installers
**Status:** ❌ NOT FOUND

**Analysis:**
- No "install from URL" features
- No package managers with remote sources
- No plugin/theme downloaders
- No dynamic dependency installation

#### Monitoring & Health Check Frameworks
**Status:** ❌ NOT FOUND (Application-Level)

**Analysis:**
- No URL pingers or uptime checkers
- No monitoring probe systems
- No alerting webhook senders
- Docker health check is infrastructure-level (out of scope)

#### Cloud Metadata Helpers
**Status:** ❌ NOT FOUND

**Analysis:**
- No AWS/GCP/Azure instance metadata callers
- No cloud service discovery mechanisms
- No container orchestration API clients
- No infrastructure metadata fetchers

### Application Architecture Analysis

**Endpoints Identified:**
1. `/` (Index page) - Renders static template
2. `/greet/` (Greeting page) - Template injection vulnerability, but no SSRF
3. `/admin/` (Django admin) - Default Django admin interface

**Request Flow Analysis:**

**Endpoint:** `/greet/` (File: `/app/webapp/views.py` lines 7-14)
```python
def greet(request):
    engine = engines["django"]
    template = engine.from_string("<html><body><h1>Hello, "+request.GET.get("name")+"</h1></body></html>")
    flag = open('/flag.txt').read()
    context = {
        'FLAG': flag
    }
    return HttpResponse(template.render(context, request))
```

**SSRF Risk Assessment:**
- **User Input:** `request.GET.get("name")` - used in template rendering
- **SSRF Risk:** NONE - no outbound requests made
- **Note:** Template injection vulnerability present, but unrelated to SSRF

**Endpoint:** `/` (File: `/app/webapp/views.py` lines 16-17)
```python
def index(request):
    return render(request, 'index.html')
```

**SSRF Risk Assessment:**
- **User Input:** None
- **SSRF Risk:** NONE - renders static template only

### Conclusion

**SSRF Attack Surface: ZERO**

This Django application has **NO SSRF vulnerability surface**. The application is a minimal web service that:
- Accepts user input via GET parameters
- Renders templates server-side
- Reads a local flag file with a hardcoded path
- Serves static HTML responses
- Makes NO outbound HTTP/HTTPS requests
- Does NOT fetch URLs or process network addresses
- Has NO external service integrations

**Why No SSRF Testing Is Required:**

1. **No HTTP Client Usage:** Despite HTTP client libraries being available in the Python environment, the application code never imports or uses `requests`, `urllib`, `httpx`, `aiohttp`, or any similar library.

2. **Self-Contained Application:** The application has no functionality requiring communication with external services, APIs, webhooks, or URLs.

3. **No URL Processing:** The application does not accept URLs as input, validate URLs, or process user-provided network addresses.

4. **Minimal Dependency Footprint:** Only Django 3.2 is installed (File: `/app/requirements.txt`), with no additional libraries for HTTP requests, image processing, or external integrations.

**Security Testing Recommendation:**

SSRF testing is **NOT applicable** to this application. Security assessment efforts should focus on the **Server-Side Template Injection (SSTI)** vulnerability in the `/greet/` endpoint, which is the primary exploitable attack vector.

---

**Report Generated By:** SSRF/External Request Tracer Agent  
**Confidence Level:** HIGH (100% code coverage achieved)  
**Files Analyzed:** 7 Python files, 1 Dockerfile, 1 docker-compose.yml, 2 HTML templates

## Authenticated Scans

### SCHEMATHESIS
Status: skipped
No API schemas found

---
Report generated at: 2025-10-27T17:46:24.634Z