I am back with another writeup I hope you Guys are hunting and earning bounty. This Time I was able to access Super Admin panel without Credentials 😎 . let’s start
I was hunting vdp program let’s call it vdp.com. There is hug scope 82k subdomain after using httpx it come to 6k subdomain. I was just scrolling and checking each subdomain one by one after some time I just open this subdomain https://selectwifi.vdp.com. I have i one problem whenever i hunt on any program I always use burp in background To see how the url open and what change happen behind the seen I open that url and I see this login page.
Step to Reproduce
- Go to this url : https://admin.selectwifi.vdp.com/dashboard-super.html
- Enjoy full Super Admin Panel.
If u see login page and there is no signup options use gospider tool or waybackurls.