Recon with a Purpose: Turning Small Clues into Hidden Attack Surfaces

I'm Mostafa, aka 0xPlayboy, and today I'm gonna share a bug I found in a public Bugcrowd program, and how a simple idea during recon led me to something interesting.

Intro

Let's call our target example.com

At first, the target looked pretty simple. It had limited features, and the whole web app was basically a dashboard showing your quota usage. The app also provided a token to use in API calls.

Nothing really interesting caught my attention at this point, except for the authentication mechanisms, but that's a story for another write-up.

First Recon Wave

First, I ran some tools to map the target, including collecting JS files, searching for secrets, gathering Wayback URLs, and collecting as many endpoints as possible.

I also went through the application, clicked on everything, and tried every available feature to send as many requests as possible to Burp History. At the same time, I used Katana to discover more endpoints.

After all that, nothing really caught my attention in the first wave.

Second Recon Wave

During the first wave, I noticed something interesting: the target had paid plans, while my account was on the free plan.

So, I started thinking: What if there are features or endpoints related to those paid plans that my account isn't supposed to access?

I tried to find endpoints related to the paid plans by analyzing the available JS files, but I couldn't find anything useful.

The Bug

I told myself, why not run Katana again, but this time, authenticated?

I loaded Katana with my authentication token and ran it again.

Embedded content

This time, the results were completely different from the first wave. Katana discovered a new set of endpoints that exposed a whole new attack surface.

I used this Katana command:

katana -u https://example.com -H "Cookie: session=<VALUE>" -o endpoints.txt

katana -u https://example.com -H "Cookie: session=<VALUE>" -o endpoints.txt

At this stage, you should take a look at the list of endpoints or use grep to filter out the noise:

grep -i "<PAID-PLAN-NAME>" endpoints.txt

grep -i "<PAID-PLAN-NAME>" endpoints.txt

You can customize your grep filter to make it more targeted and find common words that could have a deeper meaning:

grep -Ei 'admin|internal|private|premium|paid|plan|subscription|billing|payment|quota|limit|export|debug|config|secret|token|user|role|permission|feature|beta|preview' endpoints.txt > interesting.txt

grep -Ei 'admin|internal|private|premium|paid|plan|subscription|billing|payment|quota|limit|export|debug|config|secret|token|user|role|permission|feature|beta|preview' endpoints.txt > interesting.txt

You should improve this command along the journey by adding words that catch your attention.

The endpoints followed this format:

/api/private/app/api/vercel/<paid-plan-name>/<feature-in-plan>

/api/private/app/api/vercel/<paid-plan-name>/<feature-in-plan>

I found 15 endpoints, all related to features available under paid plans.

And here's the interesting part: the application had aggressive rate limiting in general, but these endpoints didn't seem to be affected by it. Also, using these endpoints didn't affect my free plan quota, and there was no need to upgrade. A free account was enough to access these features directly. Simple as that.

I then tried to increase the impact by sending the same requests without authentication, but that didn't work. So, I stopped there and focused on what I had already confirmed:

Free plan account + direct requests to paid plan endpoints = access to paid plan features without upgrading.

Key Notes

Authenticated recon can give you an extra advantage. Sometimes, it can reveal endpoints that you won't find during normal recon.
Always try unauthenticated requests. You might be able to access the same features without authentication, which could increase the impact and change the CVSS Privileges Required from Low to None.
Don't blindly run tools. Think about what you already have and what you can do with it. That's how you turn recon from random data collection into targeted recon that leads to useful findings.

Conclusion

This simple finding was a P3, but unfortunately, it was marked as a duplicate.

Still, the point of this write-up isn't just about the bug itself. It's about how to think during recon, turn simple observations into useful leads, and use your recon skills to get more out of the application.

Don't just run tools and collect data. Think about what you already have and what you can do with it.