How I accidentally found Sensitive data exposure!!

-

 Hello folks, This is Sourav. Hope you are doing awesome on the other side of the screen. I am     security enthusiast and a bug bounty hunter from India. Today I will discuss How I accidentally found a sensitive data exposure during my recon.

Okay folks let's get started without wasting any time...

One fine day I was looking for some premium themes for wordpress websites and that's how I landed upon a website which provides all kinds Web Development solutions. Since I am not allowed to reveal the name of the website so will take example.com for the sake of this writeup.

I don't know what came into me but I thought, let's see how secure is a website itself who provides web development solutions to others. If the website is itself safe enough ?? Let's find out..............


I quickly run amass on example.com and started traversing the application to see how it works. Than I noticed that amass quickly completed its operation.

So quickly I took a look at amass output and started looking for live http servers manually one be one each. 

Than this thing caught my eye and I was like ...............

I can also access the laravel logs, Oauth public/private key...................




  

Now even if this is not enough than let me tell you that I can even download all of this sensitive information along with all of the server side code locally to my computer. 



I quickly stopped my testing and made a report with all of the attached PoC and send it to example.com. And they quickly mitigated this vulnerability without any acknowledgement. 

Timeline 

6th June, 2020  ---------------------------> Report Sent

10th June 2020  ---------------------------> Mitigated without Acknowledgement.



Okay Folks that's all for now. Feel free contact me for any kind of feedback here. 

Till Then...

Stay Hydrated and Keep Hacking....








 

Comments

Post a Comment

Popular posts from this blog

Hacking wordpress websites via xmlrpc.php

-
Image
  Hello Folks, Sourav from this side. Hope you are doing awesome on the other side of the screen. I am security enthusiast and bug bounty hunter from India. In this article we will discuss about xmlrpc.php in wordpress websites by leveraging which an attacker can attack wordpress websites. So let's get started without wasting much time!! What the heck is xmlrpc.php?? If you guys don't know about xmlrpc.php than please read it about here . But in short xmlrpc.php is a simple, portable way to make remote procedure calls over HTTP. Wordpress, Drupal and most content management system supports XML-RPC. The core features that xmlrpc enabled were allowing you to connect your via smartphone, implementing tracbacks and pingacks from other sites.  Note - XML-RPC is enabled y default in all of the versions of wordpress. Let's move on with the story..... Since I am not allowed to disclose the name of the website that's why we will use example.com for the sake of this article. So f...
Read more

How I reported Google Map API key leak

-
Image
 Hello Folks,  Sourav from this side. Hope you all are in a great health and doing awesome. I am security enthusiast and bug bounty hunter from India. Today I will discuss about one of report where I reported GMap API key leak to a Bugcrowd's private program. So let's get started without wasting any time... So I was hunting on a private program and for the sake of this blog we will use example.com as I am not allowed to disclose the name of the website.  During my recon process I got a lots of different subdomain for example.coma and one of them was event.example.com. I started traversing the host to look for different functionalities. I usually do the view-source of almost every page. Suddenly this particular view-source page caught my eyes - Now the above script tag is revealing the Google Map API key.  Tip - Whenever you get an API key and you don't know how to use it. Follow this awesome  repository . GMap API key leaks... Does it matter?? First of all let m...
Read more