# [█████████] Hardcoded credentials in Android App

Hardcoded HTTP basic-auth credentials in the Zomato Android app unlocked an admin panel clone on a discovered subdomain, exposing development environment access.

- Payout: $500
- Severity: critical
- Program: Eternal
- Credited: gerben_javado
- Disclosed: 2017-07-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/246995
- Library page: https://bugbountylibrary.com/r/h1%3A246995
- Tags: domain:mobile domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:critical technique:recon technique:reverse-engineering vuln:auth-bypass vuln:secrets-leak

**Target:** Android app APK / development admin panel
**Root cause:** HTTP basic-auth credentials for a development environment were embedded in the Android app binary, and a related subdomain served an admin panel clone protected only by those credentials.
**Steps:**
1. Decompile the Zomato Android APK
2. Search strings/resources for endpoints and credentials
3. Find hardcoded HTTP basic-auth credentials tied to a domain
4. Original domain returned `503`; run subdomain bruteforce against it
5. Discover subdomain serving an admin panel clone
6. Authenticate with the hardcoded credentials to reach the admin panel
**How found:** Researcher was hunting for new API endpoints by decompiling the app and stumbled on hardcoded credentials; when the parent domain returned 503, subdomain bruteforce revealed a live host where the credentials worked.
**Exploitation:** Attacker decompiles the app, extracts basic-auth credentials, brute-forces subdomains of the associated domain to find a live admin panel clone, and logs in with the leaked credentials to gain admin access to a development environment.
**Insight:** When leaked credentials point to a dead/503 host, brute-force sibling subdomains of that domain — dev/staging clones often reuse the same auth and stay live after the main host is retired.