How I Discovered a Private Key Leak on a Company’s Subdomain

Introduction

Finding sensitive information exposed on a company’s infrastructure is always concerning. During a recent security assessment, I encountered a surprising yet critical flaw: a private key was leaked on a company’s subdomain. Here’s a breakdown of how I found this vulnerability, the steps taken to responsibly report it, and the potential impact of such a leak.

*always take proper permission before any security testing**so u don’t go to jail ;)

The Discovery

The assessment began with a standard reconnaissance phase, using tools like assetfinder and sublist3r to gather as many subdomains as possible. During the process, I focused on passive reconnaissance to avoid triggering any alerts. By filtering through hundreds of subdomains, I managed to compile a list of endpoints that looked interesting, particularly those hosting developer or staging environments.

Note: also use the help of shodan , fofa , censys , crt.sh , rapiddns to find more subdomains.

Also perform subdomain enumeration also using ASN numbers.

reference : https://www.greatheart.io/post/the-hunt-for-subdomains-a-guide-to-subdomain-enumeration

One subdomain, let’s call it redacted.company.com, stood out due to it loading a blank page. upon further analysis yielded no result.

But…in one of their endpoints..for some reason lead not only their public key..BUT ALSO PRIVATE KEY!!

(this was found through some source code analysis and networks analysis through burp) — → cant show u the private key cause u know:

ITS A SECRET!!!!!!!!!!

This key was almost certainly being used for internal purposes, allowing access to one of the company’s servers. But without additional context, the full extent of this leak remained unknown. Still, any exposure of a private key — especially one associated with a corporate environment — immediately raises red flags for potential privilege escalation or unauthorized access risks.

The Security Risks

A private key leak in any corporate environment can have devastating consequences, including:

Unauthorized Access: With a private key, an attacker could gain shell access to servers associated with the company, potentially bypassing authentication.Privilege Escalation: Once inside, attackers could leverage the compromised system to escalate privileges or move laterally within the network.Data Breach: Unauthorized access to servers could lead to data exfiltration, particularly if sensitive databases or files are stored on the affected server.Risk to Customers: If customer information or sensitive data is present on the compromised servers, it may be exposed or leaked.

Steps for Responsible Disclosure

Upon identifying the key, I knew immediate action was necessary. I documented the location of the file, its contents, and the potential risks involved. I then followed these steps for responsible disclosure:

Contacted the Company’s Security Team: Using the official vulnerability disclosure program, I reported the leak, detailing how I found the key and the associated risks.Suggested Remediation: I recommended that the company rotate all potentially affected keys and configure strict access controls on exposed directories and subdomains.Followed Up: After my initial report, I followed up to confirm the vulnerability was acknowledged, and I waited for their response before discussing it publicly.

Lessons Learned

Exposing sensitive data like private keys is more common than expected, especially when staging or development environments are insufficiently protected. This incident highlights some key lessons:

Segregate Dev and Production Environments: Private keys and sensitive data should never be stored on accessible development subdomains.Enable Directory Access Control: Using proper access controls on directories can prevent unintended file exposure.Automate Scanning: Regular automated scans for sensitive files in public assets can help detect misconfigurations before they’re exploited.if u have seen the name of the company..well done :)

Conclusion

This experience reinforced the importance of diligent recon and a security-first approach to every project. Finding sensitive data like a private key on a company’s subdomain isn’t just a noteworthy discovery — it’s a reminder of how much sensitive information is left exposed online.