# <![CDATA[Hacking a Massive Steam Scamming and Phishing Operation for Fun and Profit]]>

Blind XSS in a Steam phishing kit's username field exposed an unauthenticated admin panel controlling hundreds of stolen accounts and 2FA codes.

- Payout: $1,000
- Severity: high
- Program: Steam phishing kit
- Credited: Sam Curry
- Disclosed: 2018-05-09
- Write-up quality: 7/10
- Original: https://samcurry.net/hacking-a-massive-steam-scamming-and-phishing-operation-for-fun-and-profit
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-a-massive-steam-scamming-and-phishing-operation-for-fun-and-profit
- Tags: domain:web impact:ato impact:data-leak kind:incident platform:research sev:high tech:nodejs technique:blind technique:recon vuln:access-control vuln:auth-bypass vuln:xss

**Target:** Phishing/gambling website admin panel (Node.js/Express, socket.io)
**Root cause:** Username input reflected unsanitized into victim-facing failure message, and the admin panel at a hard-to-guess path required no authentication.
**Steps:**
1. Identify phishing domains via unique `X-Powered-By: SomeSpecificString` header and Shodan fingerprinting.
2. Submit blind XSS payload (XSS Hunter) as username on the phishing site.
3. Payload fires in admin's browser when credentials fail, exfiltrating DOM, cookies, IP, endpoint.
4. Visit leaked endpoint `ctean*******.com/admin/8vya1znto4wqoyjbkqr5q8au3xgsip08` — no auth required, logged in as admin.
5. Enumerate compromised accounts, 2FA codes, bulk-message and login-as-victim features.
**How found:** Noticed identical `X-Powered-By` header across many scam domains, Googled it, used Shodan to enumerate hosts, spotted a fake steamcommunity login page, then fired a blind XSS payload into the username field hoping the panel was unsanitized.
**Exploitation:** Attacker (researcher) used blind XSS to capture admin session and endpoint, then accessed the unauthenticated admin panel to view hundreds of compromised accounts, stored 2FA codes, and a one-click login-as-victim feature abusing Steam session storage.
**Escalation:** Single blind XSS pivoted to full admin panel takeover, exposing the entire phishing operation's victim database and account-draining tooling.
**Insight:** Fingerprint scam/phishing kits by unique response headers and Shodan dorks; their admin panels often rely on unguessable paths instead of auth, so a blind XSS in any reflected field can leak the panel URL and session.