Explore how I hunted an entire government’s db from a multi national car dealer’s forgotten folder😉

Just a directory listing that should never have been public.

TBH, I wasn’t hunting for a government breach. I was auditing and mapping the digital shadow of a luxury automotive dealership, part of a multinational conglomerate. The goal was simple when I found few exposed API endpoints, maybe a forgotten test drive form.

But but but what I found instead was a complete tps(transfer proposal system) for a state government’s IT department, with live employee records, db admin passwords, and the entire source code laid out like a red mat welcoming me xd

The Accidental Click

A routine subdomain enumeration brought up a domain. No login page, just an Apache index. At mans the directory listing was on, and the folders inside weren’t juss marketing assets.

They were:

• DB/ — multiple .xls files named after GUIDs, each a full dump of employee_detail.
• Controller/ — JavaScript files controlling authentication, user rights, and transfers.
• Handler/ — raw .ashx handlers with source code visible because ASP.NET wasn’t even processing them.
• App_Code/ — C# backend classes (though later blocked by 403, their names were listed).
• web.config — the application’s master configuration file, fully readable.

The login page title? TPS tagged with state’s IT department. This wasn’t a dealership project. It was a government HR application parked on a third‑party mail server.

What the Spreadsheets Revealed

One .xls download later, my terminal filled with columns: Employee Name | Father’s Name | Date of Birth | Mobile Number | Permanent Address | SIPF ID | Retirement Date | Designation | Official Email that even spoke me if the employee is alive or not. Over two hundred rows, real names, real government IDs,home addresses and phone numbers. Some records had retirement dates years in the past this was production data mirrored into a publicly accessible backup folder.

No SQL injection required. No authentication bypass. Just a direct HTTP GET.

The Authentication Source Code, Unmasked

LoginApp.js gave away the entire login mechanism. Two functions stood out:

• SSOLogin(): skipped the server entirely, just stored a username in localStorage and redirected. A broken client‑side shortcut, though protected by API token checks later.
• LOGIN_SECURE: called /Handler/LogoPath.ashx with a username and password, then a stored procedure USP_SSO_LOGIN validated them. The source of that handler was also exposed, showing token generation and host‑IP filtering logic.

Even the main prod site’s call‑back form had otp_status set to yes in the hidden input a potential OTP bypass if you wanted to flood their CRM with fake leads.

But the real gem was still one directory up.

The web.config That Gave Me God Mode

GET /mans/web.config returned raw XML. Among the configuration was a pair of connection strings that made my blood run cold:

xml

<connectionStrings>

<! — Production →

<add name=”con” connectionString=”Data Source=10.x.x.x,1433;Database=TransferProposalSystem;User ID=tps;Password=pSt@@#*#@2026#;Integrated Security=False;”/>

<! — Staging →

<add name=”connect” connectionString=”Data Source=VM-TPSYS-STAG;Database=TransferProposalSystem;User ID=sa;Password=dtcsarsa@$@#2026#;Integrated Security=False;”/>

</connectionStrings>

• Sa(sys admin) on staging: the SQL Server equivalent of root. Full control over every database, with the ability to enable xp_cmdshell and run OS commands.
• tps on production: direct access to the live employee transfer system, with all its data.

Both were plaintext passwords, sitting in a file accessible from anywhere.

The same config exposed internal network topology: web server at 163.x.x.2xx, database at 10.70.235.154, and an external master data web service at 2xx.xx.xx.x32 — another potential entry point.

The Blueprint: Default Admin and Schema

TableSetup.sql was also in the DB/ folder. It created every table: employees, transfers, postings, designations, departments,pvt tokens. And it inserted a default administrator:

sql

INSERT tbl_LoginUserMaster (SsoID,Name,IsActive,IsAdmin,Token,CreatedBy,CreatedDate)

SELECT ‘admin’,’app_admin’,1,1,NULL,’ADMIN’,GETDATE()

A pre‑baked admin account with full privileges. Combined with sa access to the database, you could directly inject a valid token into that table and impersonate the admin without ever seeing the login page.

The Attack Chain I Never Executed

Even without touching a live system, the passive discovery mapped a devastating kill chain:

1. Directory listing → full inventory of all sensitive files.
2. DB backups → PII of hundreds of government employees.
3. web.config → sa credentials for staging, tps for production.
4. TableSetup.sql → default admin account and complete schema.
5. Source code the only deal for REs→ authentication bypasses, internal IPs, service endpoints.

I never exploited a single thing beyond my auth😉 Well the evidence was already in plain text.