So far so good. I could report it, but if I found these two endpoints, there must be more of them. I tried to fuzz this admin endpoint some more with FUFF\u00a0 using different lists but with no luck :(. Next day with fresh mind I decided to dive into javascript files by hand. I clicked around the app , logging the requests in burp and then looking through the js files. After a while\u00a0 I found some big chunks of commented out js code. And there where some endpoints I’ve never seen before using that app. I thought that these might be some admin endpoints as they started with: delete, remove, publish, unpublish words.\u00a0 It was some kind of e-learning app, so let’s assume these endpoins were like:<\/p>\n
https:\/\/redacted.com\/app\/admin\/deleteCourse<\/p>\n
https:\/\/redacted.com\/app\/admin\/removeCourse<\/p>\n
https:\/\/redacted.com\/app\/admin\/unpublishCourse<\/p>\n
https:\/\/redacted.com\/app\/admin\/publishCourse<\/p><\/blockquote>\n
Reading js files and ajax requests I could easily construct the proper requests as I had the endpoints, the methods and the parameters.<\/p>\n
The POC<\/h3>\n
The hard part was to create the POC not damaging any data in the app. As I could not create my own course, I decided to find the endpoint which gets the course id and then based on the responses, find the one that does not exist. That was pretty easy , just using the app and logging the requests. Then I used this course id in the endpoints mentioned above. If The status code returned 200, that was the proof the endpoints were not properly secured. After some digging I found some more enpoints. I reported all the finding and was rewarded a nice bounty.<\/p>\n
<\/p>\n
Reward : 2000 USD<\/p>\n
See you next bug<\/p>\n","protected":false},"excerpt":{"rendered":"
Hello folks This time I want to tell you the story how I gained access to some admin functionalities\u00a0 and leaked some sensitive info using FUFF, Burp, my eyes, and brain :). Fuzzing Let’s call the target “redacted.com”. I started fuzzing the target with FUFF and found an \/admin endpoint https:\/\/redacted.com\/app\/admin which displayed: “Sorry you’re…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,32,29],"tags":[],"class_list":["post-439","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii","category-bug-bounty","category-write-up"],"_links":{"self":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/comments?post=439"}],"version-history":[{"count":14,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/439\/revisions"}],"predecessor-version":[{"id":457,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/439\/revisions\/457"}],"wp:attachment":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/media?parent=439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/categories?post=439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/tags?post=439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/bergee.it\/blog\/wp-content\/uploads\/2024\/10\/order_details_redacted-2.jpg\")
<\/p>\n