How I Found Two Critical PII Exposure Vulnerabilities on a HackerOne Public Program Using Pure Recon
The affected asset is anonymised at the researcher's request.
Finding critical P1 vulnerabilities isn't always about complex exploit chains or advanced exploitation techniques.
Sometimes, the most valuable findings come from systematic reconnaissance, aggressive URL discovery, and careful analysis of forgotten assets.
Here's the methodology I used to uncover two serious PII exposure vulnerabilities on a public HackerOne program.
The Target
The program offered a wildcard domain, which we'll call:
*.example.com
This meant that any subdomain under example.com was potentially in scope.
Wildcard scopes are a recon hunter's playground because the attack surface can be enormous.
My objective was straightforward:
Enumerate as many subdomains as possible, discover every reachable URL, and aggressively filter the results for sensitive resources.