API Information Disclosure Leading to Admin Account Takeover

Hi everyone! In this project, my primary responsibility was to identify vulnerabilities in the website’s APIs. I’d like to share an incident where an API information disclosure ultimately led to an Admin account takeover. Lets look into it…

To begin, I followed standard procedures by running the website’s APIs and analyzing the requests and responses using Postman and Burp Suite. During this analysis, I stumbled upon an interesting finding. In one of the API endpoints, a key named “ApiUrl” was present, accompanied by a value. However, this value was not the expected IP address but a distinct address not utilized in the website’s main domains. This piqued my curiosity and prompted further investigation.

Upon attempting to access the provided URL, I encountered a 404 error, indicating that the specified URL was not found. Nevertheless, the correct IP address indicated that there might be an alternative endpoint worth exploring. My investigation continued, and I used GoBuster to search for potential endpoints using the “seclists/discovery/web-content/big.txt” wordlist:

After GoBuster completed its scan, it revealed the existence of an endpoint named “/trs.” Upon entering “IPADDR/trs” into the browser’s URL bar, I discovered an older webpage associated with the application.

Continuing my assessment, I decided to test common administrator usernames, which led me to discover that the default username was “admin.” To uncover the password, I executed a Burp Suite Intruder attack, using a list of 500 commonly used passwords for admin users. Once the Intruder process completed, I successfully gained access to the web application with admin privileges.

In conclusion, the critical vulnerability that allowed an Admin account takeover stemmed from the API information disclosure. It’s imperative to note that developers should refrain from including the IP address of hidden websites in response packets, as this can lead to unauthorized access. Furthermore, administrators should employ robust and hard-to-guess passwords to enhance security measures.