How i got my first big Hall of fame from Nokia VDP

Firstly i does the initial recon subdomain enumeration,status codes detection,tech detection,gowtiness,crawling using katana.

Then firstly i reported some low level tomcat stack traces which results i got from nuclei that instantly got duplicated within a day . Then i got a vulnerable ssh from (CVE-2023–48795) or Terrapin Attack which is a cryptographic issue in ssh and can result in MITM attack while user interactions in ssh but that too got duplicated 😒. Then got some open redirect bugs from nuclei results and manual testing that too got dup .😡

i got 13 duplicates in total for the first time 🤣but after that got one unique bug that got my way to hof

I take a break for a day with this and started fresh next day i started doing some good level of OSINT through shodan,fofa,censys,bucket warfare for any cloud buckets left vulnerable but while checking that i found a Guacamole instance admin page with default credentials (guacadmin/guacadmin) i reported that and that too got duplicate but this time i ignored it and continued my research then i got a apache superset instance admin panel with default password(admin/admin) this time i reported it instantly then i thought even go further to get some unique bugs so i crawled the webpage and directory bruteforce and found an api endpoint “/api/v1/security/login” and lets call that website path **https://redacted.nokia.com/api/v1/security/login . **When i firstly opened it it shows this →

This was in that state before any authentication

I tried the default credential admin/admin and sent a POST request through curl with provider name db that like this :

curl -X POST "https://redacted.nokia.com/api/v1/security/login" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{"username": "admin", "password": "admin", "provider": "db"}'

i got a jwt token that when i decoded tells me that i am the not a random guest admin of that subdomain i am the super admin with all privileges in that website and even bugs like RCE,SSRF was possible with this and i can access the sensitive info and user details inside api and can edit it.

I instantly reported it waited for 2 days then that apache superset instance got duplicated but this jwt bug got accepted 😊.The satisfaction i got after this i dont know i have been finding bugs in that nokia vdp for 10 days and that was the largest time for me as i am new in this field .

❤️The happiness of getting it after 13 duplicated is on another level :)

I learnt many things from this VDP : —

1. To stay on the program whether getting dup or n/a.
2. A deep and wild OSINT is must and in my case i love doing OSINT .
3. Checking ports ,versions is a must for finding hidden admin panels etc.
4. If u find a bug that u think can go duplicate start digging in that website and try to find out more different types of bugs from it.

Bye ❤️