0

Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing:

python manage.py createsuperuser

For example, is there a default username-password pair that someone could use to gain access to django admin?

  • 2
    Django's code is open source, and you presumably have access to the database it is using. There is also documentation. Have you checked in those places? – multithr3at3d Mar 27 '18 at 23:52
  • You are right, I could have checked the source code. But for someone wandering about the same thing as me, why does he/she have to go under the same process and not spent much less time, reading an answer on this website. After all, this is why stackexchanges websites are for :-) . – pgmank Jun 5 '18 at 13:12
2

Is it possible to login with default credentials

There is no default user, and the docs state:

The username and email address for the new account can be supplied by using the --username and --email arguments on the command line. If either of those is not supplied, createsuperuser will prompt for it when running interactively.

As such there is no default user that you could login with.

If someone can execute arbitrary commands, could I be hacked

Yes, if someone can run the create user command they can make a new admin user and use it, but they could also run any command they like, so at that point you have already lost.

0

I think your question boils down to this, right?

is there a default username-password pair

If so, the answer is "no." Here's the documentation for createsuperuser

Of course, you need to also be vigilant about the general security considerations of your web app, including authentication issues not directly related to the presence or absence of a default user.

This is another great resource I suggest you look at.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.