skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-orm-injection

Exploit ORM injection flaws to leak hidden columns via relational pivots and boolean oracles.

954|172|Updated Mar 13, 2026
Search Tags:#owasp#penetration testing#prisma#Django#data exfiltration#orm injection#orm leak
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-orm-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-orm-injection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/web-application-security/exploiting-orm-injection
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-orm-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Applications that spread attacker-controlled request data directly into ORM query builders (Django, Prisma, Beego, Ransack, Entity Framework/OData) allow attackers to smuggle operators and traverse relations, leaking hidden columns like password hashes, reset tokens, and TOTP secrets. This Skill guides authorized testers through identifying, confirming, and exploiting these ORM Leak vulnerabilities.

Core Features & Use Cases

  • Framework-Specific Payloads: Ready-to-use injection patterns for Django filter(**request.data), Prisma findMany(req.body), Beego QuerySeter.Filter(), Ransack, and OData $filter endpoints.
  • Multiple Oracle Types: Build boolean, error-based, and timing (ReDoS/CONTAINS_LIST) oracles to exfiltrate secrets character by character even when no data is echoed.
  • Auth Bypass & Deny-List Evasion: Smuggle operator objects into equality checks (e.g., reset tokens) and bypass validators that only check the first __ segment.
  • Use Case: During an authorized pentest, you find a search endpoint running Article.objects.filter(**request.data). Send {"created_by__user__password__startswith":"p"} and iterate characters to recover the related user's password hash through result-set changes.

Quick Start

Ask the AI to test the target's search or filter endpoint for ORM injection by probing relational field traversal and operator smuggling payloads.

Frequently Asked Questions about exploiting-orm-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for ORM injection in Django applications?▼

Probe endpoints that pass request data into filter() with keys like field__operator, for example {"created_by__user__password__startswith":"p"}. If the result set changes based on the guessed character, you have a boolean oracle to leak hidden columns character by character.

What is ORM Leak and which frameworks are affected?▼

ORM Leak is an injection flaw where attacker-controlled keys or operators are smuggled into ORM query builders to read non-exposed columns. It affects Django, Prisma, Beego, Ransack (Ruby), and Entity Framework/OData when request data is spread directly into filter or where clauses.

Can Prisma operator objects bypass reset token checks?▼

Yes. If a reset endpoint runs findFirstOrThrow({where:{resetToken: req.body.resetToken}}), posting {"resetToken":{"not":"E"}} turns the equality check into a predicate matching any token not equal to E, resetting a victim's password without knowing the token.

How do I leak secrets when the endpoint returns identical responses?▼

Use a timing oracle: a ReDoS regex payload in Django (MySQL/MariaDB) or a Prisma OR/NOT query combined with a large CONTAINS list delays the response only when the leak condition is true, letting you infer characters without visible output differences.

Why does a deny-list bypass work with email__password__startswith?▼

Some validators (e.g., Harbor's Beego filters) check only the first __ segment against the allow-list. A key like email__password__startswith passes validation on 'email' but executes as password__startswith, reaching the sensitive field.

How do I prevent ORM injection in my application?▼

Never spread raw request data into filter/where clauses; map inputs onto an explicit allow-list of fields and operators. Validate every __-delimited segment, coerce inputs to primitive types, mark sensitive fields non-filterable, and use Ransack 4+ explicit allow-lists or per-property OData deny-lists.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

feroxbuster

Enumerate hidden directories and endpoints on web applications with recursive scans.

Community
Intermediate
camilooscargbaptistacamilooscargbaptista
7

pentest

Assess security vulnerabilities in web applications, APIs, and infrastructure using PTES methodology.

Community
Advanced
arbiterForgearbiterForge
139

secret-handling

Detect and block secret leaks in code changes.

Official
Advanced
EIS-ITSEIS-ITS

Backend Queries

Generate secure, optimized database queries with parameterized statements, eager loading, indexing, and transactions.

Official
Intermediate