Hey there!😁

I once spent an entire night refreshing a login page… Like it was going to panic and leak credentials out of fear. 😐 It didn't. It just sat there… silently judging my life choices. That's when it hit me — maybe I'm knocking on the wrong door. 🚪

🧠 When I Stopped Touching the Target…

Every bug hunter has that phase:

• clicking buttons like it's a stress-relief toy 🖱️
• sending payloads that feel powerful but do nothing 💣
• hoping something breaks just out of sympathy 😭

But one random day, I decided to do something different…

👉 I didn't touch the target at all.

No Burp Suite. No scanning. No interaction.

Just… observation. 👀

🌍 Phase 1: Watching From the Outside

I started mapping the target's digital footprint.

subfinder -d target.com -all -recursive -o subs.txt
amass enum -passive -d target.com >> subs.txt

Then filtering alive assets:

httpx -l subs.txt -silent -status-code -title -tech-detect -o live.txt

What I got wasn't just domains… It was a map of forgotten infrastructure.

And trust me… forgotten things tend to talk a lot. 😏

🧾 Phase 2: Listening to the Past

Applications evolve… But their past? It stays behind like digital fossils 🦴

waybackurls target.com | tee wayback.txt
gau target.com >> wayback.txt

Filtering:

cat wayback.txt | grep -E "\.json|\.js|api|internal|cache|cdn|config"

That's when something odd popped up:

https://cdn.target.com/assets/v3/api/proxy?route=/internal/cache/render&version=beta

It didn't look important… Which is exactly why it was. 🚩

🕶️ Phase 3: Random Late-Night Rabbit Hole

Around 2:37 AM (prime bad-decision hours), I was scrolling through random breach discussions and dev chatter.

Not even targeting this company. Just… wandering.

Somewhere in between memes and leaked configs, I saw this line:

"Edge rendering depends heavily on headers… proxy just forwards it."

That sentence stuck with me.

Not because it was dramatic… But because it was casual. Too casual. 😶

⚙️ Phase 4: Reading the App Without Touching It

Instead of interacting directly, I pulled JS files:

curl -s https://cdn.target.com/assets/app.js | grep -i proxy

And found:

fetch(`/api/proxy?route=${path}`, {
  headers: {
    'X-Render-Mode': 'edge'
  }
});

Now things started connecting.

• Proxy endpoint ✔️
• Header-based behavior ✔️
• CDN in front ✔️

This wasn't just an endpoint… It was a decision-making system.

☠️ Phase 5: The Subtle Crack

I finally made my first request.

curl -I "https://cdn.target.com/assets/v3/api/proxy?route=/internal/cache/render"

Response:

X-Cache: HIT
Via: varnish

Caching layer detected.

That's when the curiosity kicked in…

🧪 Small Experiment

curl -X GET "https://cdn.target.com/assets/v3/api/proxy?route=/internal/cache/render" \
-H "X-Forwarded-Host: example.com"

Then I refreshed the endpoint normally.

And there it was…

<script src="https://example.com/script.js"></script>

I just stared at the screen for a solid 10 seconds.

No excitement. No celebration.

Just:

"Wait… that shouldn't be there." 😶

🧩 What Actually Happened?

• The proxy trusted headers
• The cache stored the response
• The cache key didn't consider that header

So one request quietly influenced many others.

No noise. No alerts. Just… a small shift in behavior.

🧨 Payload (Nothing Fancy)

I didn't go wild with payloads.

Just something simple to confirm behavior:

<script>
console.log("cache influenced");
</script>

And even that felt… unnecessary.

Because the real finding wasn't the script.

It was the control over response flow.

🧠 The Weird Realization

I spent hours on this target…

And the most impactful moment came from:

• reading old URLs
• watching JS behavior
• connecting random external dots

Not from attacking.

Not from fuzzing.

Just… understanding.

🌑 The Other Side of the Internet

The more I explored external intelligence, the more I realized:

There's an entire world where applications accidentally expose themselves:

• old configs in public archives
• dev conversations floating in forums
• patterns reused across environments

It's messy. Unfiltered. And surprisingly honest.

Sometimes you don't find bugs there…

You find clues.

🧪 The Ending (That Wasn't One)

I documented everything carefully.

Re-tested.

Validated.

Tried to reproduce it again later…

And…

It behaved differently.

The response wasn't the same anymore. The cache didn't react the same way.

It felt like chasing a shadow that had already moved. 👤

🌀 Full Circle Moment

Days later, I came back with a fresh mind.

Re-did the same process.

Same endpoints. Same approach.

And this time…

Nothing.

No reflection. No behavior change.

Just silence again… like that login page from day one. 😐

💬 Final Thoughts

Not every story ends with a clean win.

Some bugs:

• appear briefly
• exist in specific conditions
• disappear before you fully grab them

And that's okay.

Because this taught me something more valuable than any single finding:

👉 You don't always need to attack a system to understand it 👉 External intelligence is often louder than the application itself 👉 And sometimes… the most interesting bugs are the ones that don't stay long enough

If you've ever felt stuck staring at an endpoint…

Maybe it's time to stop knocking.

And start listening. 👀

Thank you for reading! 🚀

Connect with Me!

• Instagram: @rev_shinchan
• Gmail: rev30102001@gmail.com

#EnnamPolVazhlkai😇

#BugBounty, #CyberSecurity, #InfoSec, #Hacking, #WebSecurity, #CTF.