Hi guys. This is my first bug bounty writeup. I started to bug bounty on July 22, 2019. I want to share with the community all the vulnerabilities I have found.

I choose large scope programs when looking for bug bounty programs, and to improve myself I don't care about bounty for now. So I chose SONY.

Subdomain Enumeration

I started with subdomain enumeration. Firstly, I used crt.sh and used the following patterns to find potential sub-domains.

crt.sh no longer supports wildcard queries like the ones below :(
%my%.sony.net
%jira%.sony.net
%jenkins%.sony.net
%test%.sony.net
%staging%.sony.net
%corp%.sony.net
%api%.sony.net
%ws%.sony.net
%.%.%.sony.net
%p%.sony.net
%i%.sony.net
%ff%.sony.net
%co%.sony.net

Sometimes just random letters work too.

crt.sh subdomain search

I found ppf.sony.net. Then, I used assetfinder and httprobe for subdomain enumeration and found a deep sub-domain. Here is our target:

authtry.dev2.sandbox.dev.ppf.sony.net

assetfinder -subs-only ppf.sony.net | httprobe
assetfinder + httprobe output

Directory Fuzzing

Then, I used dirsearch to look for secret directories. The default page appeared.

dirsearch.py -u "authtry.dev2.sandbox.dev.ppf.sony.net" -e html,json,php -x 403,500 -t 50
dirsearch output

Also, phpinfo was exposed — an information disclosure vulnerability. I submitted a separate report for that as well.

XSS Discovery

When I visited index.php I got this page:

index.php page with parameters

As you can see there are 2 parameters on the page. If you see parameters on an empty page, the first thing to try is XSS. I tried it and got a hit!

My favorite payload:

<img onerror="{alert`1`}" src>
XSS alert triggered

Thank you for reading! 🙏