Django Penetration Testing for Admin, API and Deployment Security
Django gives you an admin site, a permissions system and a REST framework layer for free, and the risk usually sits in how those pieces are configured rather than in the framework itself. We test the admin boundary your team configured, the object-level permissions your API actually enforces, and the settings.py values that shipped to production unchanged from development. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Django ships protections for admin access, sessions and CSRF, and a deployment checklist for the settings that are not safe by default. We test which of them are actually on in the settings.py you deployed.
Why Django findings are usually a setting, not a framework flaw
Django’s admin site is the fastest way to give staff a full CRUD interface over your data, and the fastest way to expose it is getting the permission boundary wrong. We check whether is_staff and is_superuser map to the access your business actually intends, and whether any custom ModelAdmin permission methods narrow object visibility per user rather than leaving every staff account able to see everything.
Where Django REST Framework sits on top, permission_classes and object-level checks are the layer most likely to be incomplete: an endpoint left on the default AllowAny policy, or a viewset that filters what shows up in a list but not what a direct request for one record returns. We test both, along with whether serializers let a client write to fields it should not control.
Sessions, CSRF and the handful of settings.py values Django’s own security documentation calls out, DEBUG, ALLOWED_HOSTS, SECRET_KEY and cookie flags, are the last mile most teams skip under deadline. We test what actually shipped to production, not what the deployment checklist says should have shipped.
SCOPE
What we pen test on a Django application
Admin Site Access Control
Django’s admin defaults to any user with is_staff set, and is_superuser bypasses every explicit permission check. We test whether that boundary matches who your business actually wants inside the admin, not who happened to get the flag switched on.
Custom Admin Permission Overrides
Where a ModelAdmin overrides has_view_permission, has_change_permission or get_queryset to scope staff to their own records, we test whether every code path enforces it, including bulk actions and inline edits.
DRF Endpoint Authorisation
Django REST Framework defaults to AllowAny unless a project sets DEFAULT_PERMISSION_CLASSES globally, so we check every viewset and APIView for endpoints that were never given an explicit permission_classes at all.
Object-Level Permissions and IDOR
A queryset that filters the list view but not the retrieve, update or delete action is a common Django REST Framework gap, along with has_object_permission checks that were written but never wired into the view.
Serializer Field Exposure
We test whether serializers let a client write to fields it should not control, such as an owner, role or status field left out of read_only_fields on a nested or writable-by-default serializer.
Session Cookie Configuration
We check SESSION_COOKIE_SECURE, SESSION_COOKIE_HTTPONLY and SESSION_COOKIE_SAMESITE against what actually ships, plus whether the session key rotates on login rather than persisting across the authentication boundary.
CSRF Protection Configuration
We review CSRF_TRUSTED_ORIGINS for scope wider than the frontends you actually run, and check for csrf_exempt left on a state-changing view after a debugging session.
DEBUG and Error Exposure
DEBUG left on in production hands out a full stack trace, settings values and installed apps to anyone who can trigger an error, and an ALLOWED_HOSTS wildcard removes the check meant to catch it.
SECRET_KEY Handling
SECRET_KEY signs sessions, password reset tokens and CSRF tokens, so we check it is not hardcoded in settings.py or committed to source control, and how key rotation is handled if it has ever leaked.
Python Surface Beyond the Request Cycle
Celery tasks, management commands and signal handlers run the same ORM and models as your views but sit outside Django’s per-request permission checks. If those Python processes reach beyond a single Django project, our wider Python penetration testing covers them too.
OUR PROCESS
Django Penetration Testing: From Scope to Attestation
Scope and Access
We agree the URLs, environments and any admin or API accounts we need, plus which parts of the Django project are in or out of scope, such as Celery workers, management commands or third-party auth.
Configuration and Permission Mapping
We map settings.py against Django’s deployment checklist, the ModelAdmin permission methods in use, and DRF permission_classes across every view and viewset in scope.
Manual Testing
A CREST-certified tester manually exploits weaknesses in admin access, API object-level permissions, session handling and CSRF configuration, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Django pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Django Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Django For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Django Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Django application?
We need at least two authenticated accounts for every distinct permission level in the application, including a staff account for the Django admin if it is in scope. For the API layer we need a valid token or session for each Django REST Framework permission tier you have defined, plus API documentation or a schema export if one exists.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes, outbound emails and live payment processing, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a Django penetration test take?
A single Django application sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. Applications with more user roles, a larger API surface or payment integrations move into a wider scope with more testing days.
Do you test self-hosted Django as well as managed platforms?
Yes. We test Django running on your own servers, in containers or on Kubernetes the same way as Django on a managed platform such as Heroku or AWS Elastic Beanstalk. The deployment-settings checks adjust to whichever platform you use, but the admin, API and session testing is the same either way.
Is the Django admin site included in the test by default?
Yes. If admin access sits behind a VPN, IP allowlist or network our test team cannot reach without extra setup, tell us during scoping so we can arrange access or agree to exclude it.
What is out of scope for a single-framework Django test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope for this test and covered by our cloud penetration testing service instead. A separate frontend application consuming the API, such as a decoupled React or Vue app, is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant permission_classes, ModelAdmin definitions and settings.py values alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Django have a customer penetration-testing policy we need to follow?
No. Django is framework code you deploy and control yourself rather than a shared multi-tenant service, so there is no vendor notification process to follow before testing it, unlike a hosted SaaS platform. If your Django application runs on a shared cloud platform or PaaS, that provider’s own penetration-testing policy still applies and we check it during scoping.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Django application
Django gives you an admin site, a permissions system and a REST framework layer for free, and the risk usually sits in how those pieces are configured rather than in the framework itself. We test the admin boundary your team configured, the object-level permissions your API actually enforces, and the settings.py values that shipped to production unchanged from development. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
