https://moza369.github.io/tags/data-breach/Recent content in Data-Breach on MOZAHugoen-usTue, 03 Feb 2026 00:00:00 +0000https://moza369.github.io/writeups/unauth-admin-api-access/Tue, 03 Feb 2026 00:00:00 +0000https://moza369.github.io/writeups/unauth-admin-api-access/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>REACTED</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Improper Authorization + HTTP Verb Tampering</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Critical</td> </tr> <tr> <td><strong>Reports</strong></td> <td>2 related findings</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>It started with the Wayback Machine.</p> <p>While mapping a REACTED application, I threw the wildcard scope into the Web Archive CDX API:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">https://web.archive.org/cdx/search/cdx?url=*.example.com&amp;output=text&amp;fl=original&amp;collapse=urlkey </span></span></code></pre></div><p>Among the archived URLs, a few interesting endpoints caught my eye:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">/Dtts3s/winners </span></span><span class="line"><span class="cl">/Dtts3s/valid </span></span><span class="line"><span class="cl">/Dtts3s/list </span></span></code></pre></div><p>These looked like admin panel routes for managing a promotional campaign. I hit them with GET requests — nothing. The frontend redirected or returned empty responses. The UI routes appeared protected.</p>