Penetration Test Report - Sandbox99 Chronicles

AI-driven web pentest with human-in-the-loop review, guided by django-security skill checklist. Local and live verification completed. Browser security-tool integrations reviewed and remediated.

Applicationdjango-blog-site / Sandbox99 Chronicles

Dates2026-08-18 to 2026-08-20

Targetshttps://sandbox99.local
https://sandbox99.cc

StackDjango 5.2, Gunicorn, Caddy, SQLite, Cloudflare

TesterOpenCode AI, LLM: GPT 5.4 mini, Skill: django-security

Critical Open

High Open

Medium Open

Low Open

Functional Security Fixes Resolved

Scope

Unauthenticated attack surface
Public landing page
Public security-tool endpoints
Admin access controls
User-uploaded page handling
HTTP security headers
Cookie and CSRF controls
Rate limiting and abuse controls

Out Of Scope

Authenticated admin actions beyond access-control checks
Full source-code SAST across all dependencies
Infrastructure pentest beyond web-facing Caddy behavior

Methodology

Assessment followed Django-focused controls from django-security:

Production security headers and HTTPS enforcement
CSRF protections for forms and AJAX
XSS resistance in rendered HTML and templates
SQL injection checks against search and query inputs
File upload validation and served-content handling
Authorization and staff-only endpoint checks
Cookie flags and session behavior
Rate limiting and abuse resistance
CSP behavior for browser-executed JavaScript

Executive Summary

Initial local audit found medium and low-risk issues in CSP, cookie flags, upload sanitization, clickjacking protection, and password-breach response shape. Those items were remediated. Follow-up live verification on sandbox99.cc passed with no new critical or medium findings.

Later browser verification of landing-page security tools found two integration issues: AJAX CSRF token retrieval broke after CSRF_COOKIE_HTTPONLY = True hardening, and CSP blocked third-party IP-detection APIs. Both issues were fixed without weakening core security posture.

Test Phases

Phase 1 - Local Pentest (`sandbox99.local`)

Category	Tests	Result
CSRF Protection	3	Pass
Stored XSS	4	Pass
SQL Injection	5	Pass
Path Traversal	6	Pass
Open Redirect	3	Pass
Auth Bypass	4	Pass
File Upload	3	Pass
Rate Limiting	2	Pass
Security Headers	7	Pass With Findings
Cookie Security	2	Findings
Session Management	2	Pass
Total	41	39 pass / 2 fail initially

Phase 2 - Live Verification (`sandbox99.cc`)

Category	Tests	Result
Security Headers	8	Pass
CSRF Protection	2	Pass
Stored XSS	2	Pass
SQL Injection	4	Pass
Path Traversal	2	Pass
Open Redirect	2	Pass
Host Header	1	Pass
Auth Bypass	3	Pass
Rate Limiting	2	Pass
Cookie Security	2	Pass
SSRF	1	Pass
Total	29	29 pass

Phase 3 - Browser Security Tool Verification (`sandbox99.local`)

Checked landing-page tools that call third-party services:

VirusTotal URL scanner
Password breach checker
Email breach checker
Domain availability checker
WHOIS lookup
DNS lookup
Detect IP address widget

Result:

First 6 tools failed in browser after CSRF hardening. Root cause: JS tried reading csrftoken from document.cookie after HttpOnly enabled.
Detect IP widget failed because CSP connect-src 'self' blocked browser fetches to external IP APIs.
Both issues remediated.

Findings And Status

Resolved Findings

ID	Finding	Severity	Status
F-001	Missing `Content-Security-Policy` header	Medium	Resolved
F-002	CSRF cookie missing `HttpOnly`	Medium	Resolved
F-003	CSRF cookie missing `Secure`	Medium	Resolved
F-004	`X-Frame-Options` overridden to `SAMEORIGIN`	Low	Resolved
F-005	UploadedPage `save()` not re-sanitizing on update	Low	Resolved
F-008	Password breach API returned exact breach count	Info	Resolved
F-009	Browser AJAX CSRF token retrieval broken after `HttpOnly` hardening	Info / Functional security	Resolved
F-010	CSP blocked external IP-detection APIs	Info / Functional security	Resolved

Open Findings

ID	Finding	Severity	Notes
F-006	UploadedPage extension validator checks extension only	Low	Add magic-byte or MIME validation
F-007	Comment form lacks dedicated IP-based rate limiting	Low	Math captcha present; abuse friction exists

Key Evidence

Security Controls Verified

CSRF enforcement returned 403 without valid token
Stored XSS payloads sanitized by Bleach
SQL injection payloads did not alter query behavior
Path traversal payloads returned 404
Unauthenticated admin access redirected to login
API rate limit returned 429 after threshold
Live site returned hardened headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Cross-Origin-Opener-Policy: same-origin
CSRF cookie verified with HttpOnly; Secure; SameSite=Lax

Browser Tool Fixes Verified

CSRF meta-tag approach restored AJAX POSTs for /api/scan-url/, /api/check-password/, /api/check-email/, /api/check-domain/, /api/whois/, /api/dns-lookup/
CSP connect-src allow-list updated for https://api4.ipify.org, https://api6.ipify.org, https://api4.my-ip.io, https://api6.my-ip.io

Remediation Summary

Application Changes

Added CSRF token meta tag in blog/jinja2/blog/base.html
Updated getCsrf() in blog/static/blog/js/widgets.js
Rebuilt widgets.min.js and home.min.js
Updated password-breach API to return severity bucket, not exact count
Ensured uploaded HTML pages re-sanitize on every save

Infrastructure Changes

Added CSP header in Caddy for sandbox domains
Set X-Frame-Options: DENY
Extended CSP connect-src for external IP-detection APIs

Risk Assessment

Current residual risk is low.

No open critical, high, or medium web findings
Remaining low issues need hardening, not incident response
Third-party tool widgets now align with hardened CSRF and CSP posture

Recommendations

Add magic-byte or MIME validation for uploaded files.
Add dedicated rate limiting for comment submission endpoint.
Re-run authenticated/admin pentest before major release.
Monitor third-party IP APIs; some IPv6 endpoints return 503 externally.
Keep CSP allow-list minimal and review whenever new frontend integrations are added.

Conclusion

Pentest using django-security guidance found multiple hardening gaps and two browser-security integration issues. All medium findings were fixed. Live production verification passed. Remaining exposure is low and centered on optional hardening improvements, not active exploitable gaps in tested unauthenticated flows.

Standalone HTML report. Inline CSS only. No JavaScript.