🧵Some tricks lead to Admin takeover🧵

While scanning some internal IPs I found that someone gives me 403 with a message :
"You can't access https://IP/"

So I passed the request to the proxy and changed the host header to:

Host: localhost

1/5 🧵

#bugbountytips #bugbounty And an admin login panel appeared XDD

So I tried some of the default creds, but I got an error, so I analyzed the request and figured out that the Origin and Referer headers were set to the IP, so I changed them to localhost too, and forwarded the request

2/5 🧵