It Returned 404… But the Data Was Still There
Hello Hacker👋
In this article, I’d like to share a bug I discovered while performing reconnaissance on a target. I came across a page that returned a 404 response, but the HTTP requests told a different story.
When testing a target. while performing reconnaissance. I found a page and returned 404. But the HTTP requests had other ideas.
Get Kraven_9’s stories in your inbox
Join Medium for free to get updates from this writer.
I started with some basic reconnaissance, using waybackurl and katana to collect endpoints to test. While going through the collected endpoints, I noticed something interesting: there were several admin-related pages.
Once the tool finished, I filtered the results to display only the URLs containing “admin”.
I reloaded the page normally and noticed that a table appeared and disappeared in less than a second, so I couldn’t see its contents.
I opened Burp Suite and found the surprise: the response contained all the employee data.
At that point, I understood how the site worked. It calls api/get-users and checks whether you are authorized to access the endpoint. If you are not authorized, it returns a 404.
I reached out to the person responsible for the website because they didn’t have a bug bounty program. I reported the vulnerability to him so he could fix it as soon as possible.
⚠️ Disclaimer: I do not recommend testing or working on a website without proper authorization to do so.
