# How I Pwned 10 Admin Panels and got rewarded 8000$+?

Archived /api/v1/config responses in Wayback Machine leaked admin credentials, granting access to 10 production admin panels plus dev/staging environments.

- Payout: $8,000
- Severity: critical
- Program: -
- Credited: Inderjeet Singh
- Disclosed: 2022-12-25
- Write-up quality: 6/10
- Original: https://rashahacks.com/how-i-pwned-10-admin-panels-and-rewarded-8000/
- Library page: https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical technique:js-analysis technique:legacy-endpoint technique:recon vuln:access-control vuln:auth-bypass vuln:secrets-leak

**Target:** Admin login panels and /api/v1/config API endpoints on web subdomains
**Root cause:** A /api/v1/config endpoint returned credentials in its response and was archived by the Wayback Machine; the same credentials were reused across production, staging, and development environments and across a group of 10 linked admin apps.
**Steps:**
1. Enumerate subdomains of *.redacted.com and read large JS bundles (main.js, app.js) to extract 60+ API endpoints.
2. Note `/api/v1/config` returns 404 on the live host.
3. Query Wayback Machine for archived `/api/v1/config` responses; find one archived 2 years prior containing username/password.
4. Locate admin login path `/signin` (distinct from default login) and authenticate with leaked creds.
5. Repeat on subdomain `win.vulnerable.redacted.com`: fetch archived `/api/v1/config`, log in at `/signin` with those creds.
6. From the panel's App button, pivot into 9 more panels sharing the same authorization token.
7. Manually try `win.dev-vulnerable.redacted.com/signin` and `win.stg-vulnerable.redacted.com/signin` with the same credentials; both succeed.
8. Crawl panels with Autorize for 4 hours to find unauthenticated endpoints.
**How found:** After 8 hours of JS review yielded 60+ endpoints all requiring auth, the researcher noticed `/api/v1/config` returned 404 live and hypothesized it may have been archived; Wayback Machine held a 2-year-old response with credentials. Subdomain JS revealed the same endpoint on `win.`, whose archived config had different creds. Environment naming in subdomain lists hinted at dev/stg hosts, tried manually at second level.
**Exploitation:** Attacker retrieves historical config responses from the Wayback Machine to obtain plaintext admin credentials, logs into the production admin panel at /signin, and uses the shared authorization token to access 9 additional linked admin apps; same creds also unlock dev and staging environments.
**Escalation:** Single admin panel credential pivoted via shared auth token to 9 more panels, then reused across dev/staging hosts to expand access; Autorize crawl surfaced additional unauthenticated endpoints.
**Insight:** When a config/settings API returns 404 or 403 live, check Wayback Machine and other archives for historical responses — they often contain secrets since removed. Also test leaked panel credentials against dev/staging hostnames derived by permuting environment labels into the subdomain level where the app actually lives.