Major Airline Data Dump

An airline booking system this time, with the brief claiming developers left something exposed that reveals more than it should. Same Nagli-hosted Bug Bounty Masterclass series as the cookie-switching one, built around a real finding of his that exposed thousands of passengers' personal information, booking details, and flight itineraries. Same situation as that one too, no public writeup naming the actual airline, so rather than guess at attribution I'm just approaching this the way he would've, as an actual bounty hunter working a target, not as someone chasing a string labeled "flag."

Started by just browsing the site itself the normal way, checking page source and whatever functionality was actually reachable before going anywhere near scanners.

Static page front to back, no exposed JS worth chasing, no API calls firing in the background the way that cookie-switching target had. Nothing to grab onto from the site itself, which meant the actual surface had to be sitting somewhere else entirely, other endpoints, other ports, or a subdomain I hadn't looked at yet.

Ran subdomain enumeration against the root domain, and since this challenge shares its root with several others on the same platform, deepleak and the router-resellers pair both showed up in the same list, I had to actually isolate the ones relevant to this specific target rather than treating the whole list as in scope. airlines and api.airlines were the two that mattered here, so those got pulled out and saved separately for their own targeted scan.

Hitting the API subdomain directly came back with a plain 404, which doesn't actually mean much on its own, an API root returning nothing is completely normal when the real paths are sitting one or two levels deeper. Being an API specifically, that meant fuzzing for endpoints made more sense than a generic directory brute force.

Fuzzing with a common wordlist turned up a /docs path, and running nuclei with its swagger-api template against the same host confirmed it from a second angle, landing on the exact same endpoint. A live Swagger doc sitting open on a production API is basically a full blueprint of the backend handed to you for free, every endpoint name, every parameter, no guessing required.

Most of what was listed in there turned out to be useless without already having something to query with, an email address or a member ID, neither of which I had yet. Went back through the site's JS looking for anything leaking either of those, same as before, and came up empty there too. So it came down to just working through each documented endpoint by hand instead, one at a time, until one of them actually gave something back without needing a lookup value supplied first.

getMemberships was that one, returning full membership details including an actual member ID with absolutely nothing supplied in the request beyond the base URL itself. No auth, no parameters, nothing gating it at all.

With a real member ID sitting in hand now, feeding it into the other documented endpoints opened up considerably more, flight history, payment details, full contact and account information, name, date of birth, phone number, home address, a partially masked card number, tier status, the works, an entire passenger profile rebuilt from endpoints that individually looked harmless until you actually had the one ID needed to unlock all of them at once. Pulling membership info with that same ID handed back the flag sitting right inside the same JSON response as everything else.

Flag down, but the actual point of this one was never really about getting that string. The endpoint doing the real damage was getMemberships, sitting there willing to return a valid member ID to literally anyone who asked, with zero authentication standing between an anonymous request and a working key into every other endpoint behind it. One leftover, unauthenticated lookup turned an entire well-documented, individually reasonable-looking API into a full PII dump for anyone patient enough to read the Swagger doc and try each path in turn. Dead endpoints and forgotten ones aren't actually dead if they're still answering requests, they're just quiet until someone happens to hit them.

Happy hunting, see you in the next scope :)