# P1: Critical - Discovering and Foiling a Threat Actor

Exposed Laravel DebugBar leaked admin credentials and .env secrets, giving full takeover of a mail-marketing app used by a spam campaign.

- Payout: $1,550
- Severity: critical
- Program: -
- Credited: Jackson Henry, John Jackson
- Disclosed: 2020-09-27
- Write-up quality: 6/10
- Original: https://johnjhacking.com/blog/p1-critical-discovering-and-foiling-a-threat-actor/
- Library page: https://bugbountylibrary.com/r/blog%3Ajohnjhacking-com-blog-p1-critical-discovering-and-foiling-a-threat-actor
- Tags: domain:web impact:ato impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:php technique:recon vuln:info-disclosure vuln:misconfiguration

**Target:** PHP Laravel web application login portal and .env endpoint
**Root cause:** Laravel DebugBar left enabled in production exposed request history including SQL queries, credentials and JWTs; a separate endpoint exposed .env variables including DB credentials.
**Steps:**
1. Enumerate subdomains with Amass, screenshots with Aquatone, Shodan; find IP hosting a web app
2. Browse `http://X.X.X.X`, observe Laravel DebugBar button on login portal
3. Click DebugBar, read listed GET/POST requests containing SQL queries, credentials, JWT tokens
4. Extract admin credentials from POST to login URL, log in to mail-marketing console
5. Request the exposed `.env` URL to obtain DB credentials
6. Connect: `mysql -h x.x.x.x -u username -p`
**How found:** Routine recon surfaced an unfamiliar mail-server IP with a login portal; the visible Laravel DebugBar button was recognized as leaking request data, prompting inspection of its request list.
**Exploitation:** Attacker reads DebugBar request history to harvest admin credentials, logs into the marketing console with command over 13 connected servers, then pulls .env to authenticate directly to the MySQL backend.
**Escalation:** Pivoted from app account takeover to backend database access via leaked .env credentials; discovered 1.7M emails and 5M spam messages across 13 companies' nameservers.
**Insight:** A visible Laravel DebugBar on a production login page is a credential goldmine: its request history often contains plaintext login POSTs and JWTs, and pairing it with a reachable .env endpoint yields direct DB access.