How I Found My First Bug: Information Disclosure via Exposed Directory Listing

Introduction

While conducting a routine reconnaissance and asset discovery phase on a target bug bounty program back in January 2025, I stumbled upon a common yet misconfiguration that often slips past developers: an exposed static directory listing.

In this write-up, I want to walk you through how I discovered this information disclosure vulnerability, starting from a seemingly dead subdomain all the way to uncovering exposed server files, version control artifacts, and tracking how the issue was eventually remediated.

The Discovery & Reconnaissance (From "Page not found" to Hidden Directory)

During the enumeration process, I used subdomain enumeration tools to discover potential targets belonging to the organization. One of the subdomains I found initially returned a Page not found or seemed completely inactive when visiting it directly in the browser.

However, instead of ignoring it, I decided to run a directory and path fuzzing session using ffuf to check for any hidden paths or directories that might be lurking beneath the surface.

ffuf -u https://sub.domain.com/FUZZ -w wordlist.txt -mc 200

ffuf -u https://sub.domain.com/FUZZ -w wordlist.txt -mc 200

After running the fuzzing process, I noticed that a specific path responded successfully, revealing a hidden directory named static:

https://sub.domain.com/static/

https://sub.domain.com/static/

When I navigated to that URL, instead of a standard 403 Forbidden or error page, the web server responded with an open directory index (Index of /static). This meant that directory listing was enabled on the server, exposing the entire file tree structure of that directory to anyone on the internet.

Technical Details & Exposed Assets

Upon inspecting the directory index, I found several sensitive files, configuration scripts, and version control artifacts exposed:

1. JavaScript Configuration Files: Files like idpselect.js and idpselect_config.js were directly accessible, revealing internal logic and client-side setup parameters.
2. Administrative Assets: Sub-directories such as /admin/js/jquery.min.js and other internal script folders were visible.
3. Version Control Artifacts (.svn): The presence of .svn/ directories (though restricted with a 403 status in some parts) strongly indicated potential version control and source code exposure artifacts left over on the production server.

Security Impact

An exposed static directory and version control artifacts carry multiple security risks if leveraged by a malicious actor:

• Information Disclosure: Exposing server-side configurations, internal file paths, and naming conventions helps attackers map the application architecture.
• Attack Surface Expansion: Exposed JavaScript and configuration files can sometimes contain hardcoded API endpoints, internal parameters, or logic flaws that pave the way for further exploitation.
• Source Code Leakage Risks: Remnants like .svn can potentially allow attackers to reconstruct parts of the application's internal structure.

Program Response

Every bug hunter knows the bitter-sweet feeling of receiving a "Duplicate" status on a report. After submitting this finding to the program, the triage team closed the report as a duplicate because another researcher had reported it slightly earlier.

However, finding a bug is only part of the learning curve, tracking how platforms handle security over time is another. When I decided to look for the exact same static endpoint (/static/) later on, I noticed a significant change.

The organization had cleaned up their assets, sensitive version control folders .svn/ and internal testing paths were removed, showing that the security team eventually hardened the endpoint.

Conclusion

Writing about this journey reminded me of two essential lessons every bug hunter should keep in mind:

1. Never Judge a Subdomain by its "404": Just because a subdomain or endpoint returns a 404 Not Found or seems completely dead at first glance, it doesn't mean there's nothing there. Persistence, proper reconnaissance, and thorough path fuzzing using tools like ffuf can reveal hidden directories and critical misconfigurations that others easily overlook.
2. Never Get Discouraged by Duplicates: Receiving a "Duplicate" status on a report can be frustrating, but it's a normal part of the bug bounty lifecycle. It simply means you're on the right track and looking at the right targets. Keep pushing forward, learn from every submission, and your hard work will eventually pay off.

Keep hacking, stay curious, and see you in the next write-up.