(Oct 21, 2025 05:25 PM)onlineuser | D3RFER Wrote:  About six months ago I found an information-disclosure issue at a big company, but it wasn’t serious enough for their hall of fame.

6 months later, I decided to give it another try.
Today I spent six hours scanning subdomains and looking them through. 
( 1007 subdomains )  and found two issues.
IDOR and a client-side authorization bypass by disabling JavaScript in my browser.

I was SO close to an SQL injection but couldn’t get it, so I stopped. I decided to relax and watch YouTube, before sleeping.

The first ad that played was from the same company I’d been testing. Yup, felt like salt in the wound.

(Oct 21, 2025 05:47 PM)Palestine Wrote:  You could make a great career out of doing that for major companies. I know they'd pay a fortune for that kind of work. You should definitely look into it, if I was skilled enough in this field I'd definitely do it.

(Oct 21, 2025 06:40 PM)Jinu Wrote:  Damn, that ad at the end is peak irony. Nice persistence. 1007 subdomains is patience of a saint.

(Oct 21, 2025 08:25 PM)PacketPilot Wrote:  Best part’s when your report gets validated fast. Worst is when they ghost you for months.

(Oct 22, 2025 04:47 AM)onlineuser | D3RFER Wrote:  Indeed that is very true. I already do this kind of work for multiple companies. But I do not making living of it, I believe there’s easier ways to make money tbh.

---

Thanks. Yeah it took some patience, but basically you scale down from 1,000 subdomains to few hundreds pretty quick.

Using whatever subdomain finder you prefer & afterwards doing live check with httpx. What comes afterwards is the real hunting. When you have to manually look through them all for possible vulnerabilities & dig for possible subdomain takeovers.

Not to long ago, I actually managed to do a subdomain takeover buying an expired LTD & settings up a certificate.

---

Either that or worst part is a duplicate.