# Base alpha version code exposure

Open Jenkins instance on port 8081 exposed Zomato Base alpha source code and MySQL/SMTP/SMS credentials, enabling database and email takeover.

- Payout: hidden
- Severity: high
- Program: Eternal
- Found by: cha5m
- Disclosed: 2016-10-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/167859
- Library page: https://bugbountylibrary.com/r/h1%3A167859
- Tags: area:cloud domain:infra domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high technique:recon vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Jenkins server on alternate HTTP port 8081
**Root cause:** Jenkins instance was left unauthenticated and connected to multiple GitHub accounts, exposing full source code and embedded credentials for MySQL, SMTP, and SMS services.
**Steps:**
1. Recon found a self-signed SSL certificate with organization name Zomato.
2. Navigated to server on port 80, found default Laravel installation.
3. Ran a port scan and discovered alternate HTTP port 8081.
4. Navigated to port 8081 and found a completely open Jenkins instance.
5. Jenkins was authenticated to multiple GitHub accounts and contained Android, Dashboard, and Laravel source code.
6. Source code included keys to a Zomato Base alpha MySQL server, SMTP server, and SMS service.
**How found:** Started with recon noticing a self-signed cert naming Zomato, found a default Laravel app on port 80, then ran a port scan out of curiosity and discovered Jenkins on port 8081.
**Exploitation:** Attacker accessed the unauthenticated Jenkins on port 8081, pulled the full Base alpha source code, and extracted MySQL, SMTP, and SMS credentials, achieving complete database and email takeover of Zomato Base alpha.
**Escalation:** Credential extraction from leaked source escalated source disclosure to full database and email takeover.
**Insight:** Self-signed certs naming the org are a recon signal; always port-scan hosts with default-looking apps, since alternate ports often expose unauthenticated CI servers holding source and secrets.