Thread by @0xmahmoudJo0

🧵Some tricks lead to Admin takeover🧵

While scanning some internal IPs I found that someone gives me 403 with a message :
"You can't access https://IP/"

So I passed the request to the proxy and changed the host header to:

Host: localhost

1/5 🧵

#bugbountytips #bugbounty

And an admin login panel appeared XDD

So I tried some of the default creds, but I got an error, so I analyzed the request and figured out that the Origin and Referer headers were set to the IP, so I changed them to localhost too, and forwarded the request

2/5 🧵

Then Finally, I got an error about the wrong username or password, so I started to test some default creds,
but I got nothing, then I discovered that there's no rate limit, so it's brute-force time, but brute-forcing with all usernames and passwords is such a mess

3/5 🧵

So I decided to do some trick, the reset password function tells if the user exists or not, so I brute forced to get the username and I got a valid one XDDD

Then now I have a username, it's time to brute-force the password

4/5 🧵

And with a simple password list, I brute-forced and managed to get a valid one that matched with the username I had got

I entered the creds, and I logged in as admin XDDD

NOTE: all these processes are done by adding localhost to Host, Origin, and referer headers
#PenTest
5/5 🧵