Post cover image

September 10, 2026

I Stopped Hunting for Vulnerabilities and Started Hunting for Misconfigurations

Why some of the easiest security findings are hiding in plain sight

By Jakkali Lokesh

2 min read

Why some of the easiest security findings are hiding in plain sight

When I first started learning bug bounty, I thought finding vulnerabilities meant discovering complicated exploits.

SQL injection.

XSS.

Authentication bypasses.

Remote code execution.

Those are obviously interesting, but there's a problem with focusing only on them:

You can miss a lot of real security issues.

Over time, I started paying more attention to something much less exciting on the surface:

misconfigurations.

And honestly, that's where things started getting interesting.

What Is a Misconfiguration?

A misconfiguration is basically when a system is deployed or maintained in a way that creates unnecessary security exposure.

It doesn't necessarily mean someone wrote vulnerable code.

Sometimes the code is perfectly fine.

The problem is how the infrastructure around it was configured.

For example:

Application
    ↓
Cloud service
    ↓
DNS
    ↓
Storage
    ↓
Permissions

One wrong configuration somewhere in that chain can create a security problem.

The DNS Example

One of the clearest examples is a dangling DNS record.

Imagine:

old.example.com
        ↓
old-app.herokuapp.com

The company deletes the Heroku application but forgets the DNS record.

Now:

old.example.com
        ↓
Deleted resource

If someone else can claim that resource, the attacker may be able to control content served through the company's subdomain.

That's how a seemingly harmless DNS record can turn into a security issue.

What I Now Check During Recon

When I get a new authorized target, I don't immediately start throwing payloads at it.

I first try to understand the attack surface.

1. Subdomains

Look for:

dev.example.com
staging.example.com
old.example.com
api.example.com
assets.example.com

Old infrastructure is particularly interesting because it is more likely to contain forgotten resources.

2. DNS

Check where those domains actually point.

dig subdomain.example.com +short

I'm interested in CNAMEs and external services.

3. Cloud Storage

Look for publicly accessible buckets or accidentally exposed resources.

The important question isn't simply:

"Is this cloud storage?"

It's:

"Who can access it, and what can they do?"

4. Exposed Dashboards

Development and monitoring systems sometimes end up publicly accessible.

Examples include:

Jenkins
Grafana
Kibana
Argo CD
Kubernetes dashboards

Again, exposure doesn't automatically mean vulnerability.

You need to determine whether authentication and authorization are properly implemented.

5. Third-Party Services

Companies depend on hundreds of external services.

That's a huge attack surface.

A forgotten integration can sometimes be more interesting than the main application itself.

The Mindset Change

The biggest change for me was stopping the mindset of:

"What payload should I try?"

and replacing it with:

"What is this system trusting that it shouldn't?"

That question leads to much better reconnaissance.

Look at:

DNS
Permissions
Cloud resources
Third-party services
Authentication
Access control
Deployment configuration

before trying to exploit anything.

The Important Part

Not every misconfiguration is a vulnerability.

A public endpoint isn't automatically vulnerable.

A CNAME isn't automatically a takeover.

A cloud bucket isn't automatically exploitable.

A dashboard isn't automatically a critical finding.

Context matters.

The job isn't to find something that looks strange.

The job is to prove that the strange configuration creates a security impact.

Final Thought

You don't always need a sophisticated exploit to find a security vulnerability.

Sometimes you just need to look at the things developers forgot about.

That's why misconfigurations are now one of the first things I look for during reconnaissance.

The boring infrastructure is often where the interesting bugs are hiding.