Post cover image

September 6, 2026

Exposed Django Debug Mode on a Development Subdomain

Information Disclosure via Django Debug Mode

By MaMad

1 min read

Introduction

While performing reconnaissance on a web application, I noticed an interesting pattern in the company's subdomains.

I came across several subdomains following a similar naming convention:

app.redacted.com
app-dev.redacted.com
blog.redacted.com
blog-dev.redacted.com
admin.redacted.com
admin-dev.redacted.com
forum.redacted.com
forum-dev.redacted.com
visionhub.redacted.com

The consistent -dev naming pattern caught my attention. Since development environments are often configured differently from production, I decided to take a closer look at these subdomains.

One of the interesting assets was:

visionhub.redacted.com

Since similar subdomains had a corresponding development environment, I manually tested:

visionhub-dev.redacted.com

The subdomain was accessible, so I decided to investigate it further.

Since I had previously worked with Django, I recognized the framework from the application's behavior. I then checked the technology stack with Wappalyzer, which confirmed that the application was using Django.

I then appended just a random string to the end of the URL:

visionhub-dev.redacted.com/any_random_string

BOOM 💥

The application returned a detailed Django error page, confirming that Django Debug Mode was enabled.

Steps To Reproduce:

  1. Open a web browser
  2. Navigate to: https://visionhub-dev.cbre.com/
  3. The server responds with a Django Debug error page, confirming that DEBUG = True is enabled.

Impact

Django Debug Mode can expose sensitive application details, including:

  • Environment variables
  • Application configuration details
  • Internal file paths
  • Framework/library versions

The Interesting Part of the Discovery

What made this finding interesting for me was not the Django error itself.

The important step was noticing the subdomain pattern:

production
    ↓
visionhub.redacted.com
development
    ↓
visionhub-dev.redacted.com

Instead of ignoring the development subdomain, I asked myself:

"Could the development environment be configured differently from production?"

That question led me to investigate the environment and eventually discover the exposed Django debug page.

Conclusion

This finding was a good reminder that reconnaissance isn't only about collecting as many subdomains as possible.

In this case, a simple difference in the subdomain naming convention led to an exposed development environment and publicly accessible Django debug information.

The key takeaway: don't just enumerate assets. Understand the relationships between them.