Hi everyone,
In this post I want to share a quick win from my bug bounty recon: how a single uncover query found the exposed origin server of a company’s payment system, a finding that was rewarded with a $750 bounty.
Starting with deep recon
When I start on a bug bounty program, I spend a lot of time on reconnaissance before testing anything. The goal is to find assets the company may have forgotten about: old subdomains, staging servers, and servers that are reachable directly on the internet when they should only be reachable through a CDN or web application firewall (WAF).
One of my favourite tools for this is uncover by ProjectDiscovery. It queries internet-wide search engines such as Shodan, Censys and FOFA from one command line, so you can quickly see which hosts and open ports are publicly associated with a target.
The query
This is the command I ran against the in-scope domain:
uncover -q "target.com" -e shodanIt asks Shodan for every host it has indexed that is associated with the domain. Among the results was an IP address serving the company’s payment application directly, bypassing the CDN in front of the main site, along with the ports used by its payment services.
Why an exposed origin matters
Many companies protect their public website with a CDN or WAF, which filters malicious traffic and hides the real server. If the origin server’s IP is also reachable directly, an attacker can simply skip that protection layer. For a payment system, that means:
- WAF rules, rate limiting and bot protection can be bypassed.
- Services and ports that were never meant to be public are exposed to scanning and attack.
- Any vulnerability on the origin becomes much easier to exploit.
I reported the exposed origin to the program with the evidence. It was rated critical and rewarded with a $750 bounty.
How to fix it
If you run a service behind a CDN or WAF:
- Allow inbound traffic to the origin only from your CDN or WAF provider’s IP ranges.
- Close every port that does not need to be public, and put admin and internal services behind a VPN.
- Rotate the origin IP if it has been exposed, because it will stay in search engine indexes.
- Run the same tools attackers use, such as uncover and Shodan, against your own domains on a regular schedule.
Takeaway
Recon is often where the easiest high-impact bugs are found. If you are getting started, read the basics of bug bounty hunting. If you want your own attack surface reviewed before someone else finds these gaps, see my vulnerability assessment and network penetration testing services.
Happy hunting, and keep it ethical!
