How I Found My First P1 Bug ??

Hello everyone, this is the first bug I have found.

Shall we begin? Let me tell you, it’s part of a VDP program, and this is a P1 vulnerability.

When I started hunting on this website, I used my own methodology, which we can discuss in another blog.

When I began hunting on the main domain, I didn’t find anything because it was secure. After that, I started searching for subdomain URLs using WaybackURLs. I found a lot of URLs, so I checked them manually, one by one. It was a really hard task, but I used the Bulk URL Opener extension in Chrome. After that, I found an admin panel.

I tried logging in with default credentials like ‘admin’/’admin.’ I created some permutations of default usernames and passwords and applied them one by one. Eventually, I logged in using default credentials and accessed the dashboard.

After I reported the bug and received swag from the company, I was very happy at that moment.