# Optimizing Hunting Results in VDP for use in Bug Bounty Programs - From Sensitive Information Disclosure to Accessing Hidden APIs which can be used to Retrieve Customer Data

Hidden legacy API endpoint still accepted POST requests, letting an attacker with a low-priv account retrieve customer PII for ~10,000 enumerated emails.

- Payout: $2,500
- Severity: critical
- Program: -
- Credited: YoKo Kho
- Disclosed: 2020-11-15
- Write-up quality: 7/10
- Original: http://www.firstsight.me/2020/11/optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclosure-to-accessing-hidden-apis-which-can-be-used-to-retrieve-customer-data/
- Library page: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:critical technique:chained technique:legacy-endpoint technique:recon vuln:access-control vuln:auth-bypass vuln:idor vuln:info-disclosure

**Target:** Web portal API endpoint (/api/vx/.../3rdEndpoint)
**Root cause:** Developers replaced the customer-data API with a new version but left the old endpoint reachable in production; it still returned full customer details and had no rate limiting.
**Steps:**
1. Enumerate subdomains; find weaksub.target.tld login without CAPTCHA (6-attempt limit, 15-min block).
2. Brute force with credential patterns from GitHub recon; obtain valid accounts.
3. Log into mainredacted.target.tld with an account having 'Internal Resources' access.
4. Observe new UI calls `GET /api/vx/.../2ndEndpoint?ParameterContainUserEmail=...` which returns no PII.
5. Replay old endpoint from prior report screenshot: `POST /api/vx/6thRedacted/3rdEndpoint` with body `ParameterContainUserEmail=victim@x` and valid session cookie/CSRF token.
6. Iterate over ~10,000 enumerated emails; no rate limit, ~10 min to find accounts with customer PII.
**How found:** Author kept old recon artifacts (Jira screenshots, enumerated emails, credential patterns) for years. Noticed the new UI no longer returned customer data, inspected the request, saw the endpoint changed, then recalled a Burp screenshot from a prior report showing an older API path and replayed it.
**Exploitation:** Attacker needs one valid low-priv account with Internal Resources access. Using the still-live legacy POST endpoint, they submit arbitrary customer emails and receive full customer personal data; no rate limiting allows mass enumeration of ~10,000 emails in ~10 minutes to identify which internal accounts hold customer PII.
**Escalation:** Chained weak login (no CAPTCHA) + reused credential patterns + hidden legacy API + missing rate limit to convert a points-only finding into a paid P1 data-leak.
**Insight:** When a vendor 'fixes' a data-exposure feature by swapping endpoints, the old API often remains live in production; replay every historical endpoint captured in past screenshots/reports against the new session.