The Subdomain Subfinder Missed: How a German Wordlist Led Me to a Hidden Bug (and a CHF 100…

If you've spent enough time doing bug bounty, you've probably experienced this:

You run your favorite reconnaissance tools.

They return a decent list of subdomains.

You test them.

Nothing exciting.

You start questioning your life choices.

That was exactly where I found myself.

Little did I know that one small change in my reconnaissance approach would uncover a hidden application, lead to an interesting authentication issue, and end with one of the most unexpected bug bounty responses I've received.

The Recon That Almost Ended Early.

The target was a German organization. Like always, I started with passive reconnaissance using Subfinder.

The domain used wildcard DNS, but Subfinder still returned a respectable number of subdomains.

I tested them one after another.

Nothing.

No interesting endpoints.

No hidden admin panels.

No forgotten APIs.

Just… silence.

At that point, many hunters (including me on a lazy day) would probably move on to another program. But something kept bothering me.

"What if passive sources simply don't know everything?"

Time to Wake Up Gobuster.

Since the target was German, I had an idea.

Instead of using a generic DNS wordlist, why not use a German DNS wordlist?

It sounded reasonable.

Organizations often name internal services using their native language.

So I fired up Gobuster.

Then I waited.

Gobuster happily kept trying names while I happily kept pretending to be patient. A few minutes later…

One hostname appeared. One.

energieportal.target.com

energieportal.target.com

It wasn't in Subfinder's results. None of my passive sources knew it existed.

Gobuster had just introduced me to a brand-new target.

Sometimes all a recon tool needs is a better dictionary.

Jackpot… Maybe?

Opening the subdomain revealed what looked like an energy customer portal.

Great.

Time to log in and start breaking things.

(Responsibly, of course.)

After spending some time exploring the application, I eventually reached one of my favorite buttons to test.

Logout.

The Logout That Didn't Feel Like Logging Out.

I clicked Logout.

A nice green notification appeared.

Success — You have signed out.

Perfect.

Mission accomplished.

…or so I thought.

Less than a second later another notification appeared.

Success — Successfully signed in as my account.

Wait…

Didn't I just log out?

The page didn't redirect.

The dashboard didn't disappear.

Every authenticated feature continued working exactly as before.

The application had basically looked me straight in the eyes and said,

"Trust me bro, you logged out."

Closing the Browser Didn't Help Either.

Maybe the session would disappear after closing the browser?

Nope.

I closed the tab completely.

Opened a new one.

Typed the application's URL.

Pressed Enter.

My account opened immediately.

No email.

No password.

No MFA.

Nothing.

Apparently my "logout" had all the security effectiveness of clicking the close button on a calculator.

Looking Under the Hood.

Now I was curious.

I inspected the session cookies.

Interestingly, the application generated a new session cookie after logout.

That looked promising…

…until I restored the original session cookie I had exported before logging out.

The server accepted it immediately.

The old session was still alive.

At this point it became clear:

The logout process wasn't actually terminating authenticated sessions.

Reporting the Finding.

I documented everything carefully:

• The logout flow.
• The misleading success messages.
• Persistent authenticated sessions.
• Browser closure testing.
• Session replay observations.
• The potential impact on shared computers.

Then I submitted the report and waited.

Like every bug bounty hunter knows…

Waiting for triage is its own vulnerability.

The Verdict.

The security team responded with the following:

"Unfortunately, we consider this finding Informative, as there is little to no information for an attacker to gain, nor is there a direct CIA security impact."

Ouch.

But then came the twist.

"Nevertheless, we decided to give you a bonus as this gives us some complementary insights."

Along with that message came a CHF 100 reward.

Not exactly the High severity report I had imagined…

…but definitely one of the friendliest rejection emails I've received.

I'll take it.

Impact.

Although the issue was ultimately classified as Informative, it demonstrated behavior that could still pose practical risks, particularly on shared or public devices.

Potential impacts included:

• Users believing they had securely logged out while their authenticated session remained active.
• Unauthorized access if another person used the same computer after the victim left.
• Continued access to account information without requiring re-authentication.
• Increased opportunities for session misuse due to ineffective logout behavior.
• Reduced user confidence in the reliability of the authentication process.

The program concluded that the issue did not create a direct Confidentiality, Integrity, or Availability (CIA) impact, but still appreciated the report as useful security feedback.

Lessons Learned.

This hunt reminded me of four simple things:

• Passive reconnaissance doesn't find everything.
• Wordlists tailored to the target's language can reveal overlooked assets.
• Interesting findings don't always become High severity reports.
• Sometimes discovering the hidden application is the real achievement.

Final Thoughts.

Looking back, the most valuable part of this engagement wasn't the vulnerability itself.

It was the discovery.

A single DNS wordlist uncovered an application that passive reconnaissance completely missed. Without that extra step, I never would have tested the portal or learned anything about its authentication flow.

And honestly?

That's one of the reasons I enjoy bug bounty.

Every engagement is a reminder that curiosity often pays better than automation.

Sometimes it pays with a critical vulnerability.

Sometimes it pays with CHF 100 and a story worth telling.

Either way…

I'll keep clicking Logout just to make sure it actually means what it says.

Happy Hunting. 🛡️