Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing:
python manage.py createsuperuser
For example, is there a default username-password pair that someone could use to gain access to django admin?
There is no default user, and the docs state:
The username and email address for the new account can be supplied by using the --username and --email arguments on the command line. If either of those is not supplied, createsuperuser will prompt for it when running interactively.
As such there is no default user that you could login with.
Yes, if someone can run the create user command they can make a new admin user and use it, but they could also run any command they like, so at that point you have already lost.
I think your question boils down to this, right?
is there a default username-password pair
If so, the answer is "no." Here's the documentation for createsuperuser
Of course, you need to also be vigilant about the general security considerations of your web app, including authentication issues not directly related to the presence or absence of a default user.
This is another great resource I suggest you look at.
