11/01/2025
Bug Bounty Win: 💰 $200 for Username Enumeration - Powered by Selenium!
Yes, you read that right—F.Tech secured a $200 reward 🏆 for uncovering a username enumeration vulnerability! But this wasn’t just any typical case. Let me take you through the thrilling journey where automation 🤖, creativity 💡, and persistence 💪 turned a hidden bug into a valuable discovery.
---
The Challenge:
While exploring a bug bounty program’s policy, we noticed username enumeration was listed as a valid vulnerability. Initially, it seemed like a straightforward task for F.Tech. However, the reality was quite different.
After thoroughly testing three domains within scope 🌐, we couldn’t find any direct functionality that revealed usernames or emails. At first, it felt like a dead end—until we stumbled upon a subtle vulnerability in the "change email" feature.
🔎 Here’s what we discovered:
Submitting a valid email triggered a 302 response ➡️.
After the 302, the server made a follow-up request, and its response revealed whether an email was already in use or not.
---
The Twist:
The 302 response alone wasn’t enough to differentiate valid and invalid emails. However, by carefully analyzing the follow-up request and its response, we identified a pattern 🔄 that exposed email enumeration indirectly 🚨.
---
The Roadblock:
When we initially reported this finding, the security team 🛡️ marked it as invalid ❌, stating that username or email enumeration couldn’t be performed at scale. That’s when we decided to bring in the power of Python 🐍 and Selenium 🖥️ to demonstrate the full impact.
---
The Automation Solution:
Using Python and Selenium, we automated the entire process to prove that enumeration could indeed be done at scale:
1️⃣ Wrote a Python script using Selenium to input a list of 100 emails 📧.
2️⃣ Automated interactions with the "change email" feature, capturing responses systematically.
3️⃣ Developed a simple UI to flag 🚩 which emails were already in use.
This approach not only saved time ⏳ but also demonstrated the vulnerability's potential impact 💥, ultimately changing the outcome of our report.
---
The Outcome:
🎉 The bug report was accepted, and F.Tech earned $200! Beyond the monetary gain, this experience reinforced the value of automation and perseverance in solving complex challenges.
---
Key Takeaways:
✅ Small vulnerabilities can have a big impact: Creativity and attention to detail are crucial in bug-hunting.
✅ Selenium is a game-changer: Automation tools like Selenium are indispensable in cybersecurity and bug bounty hunting.
✅ Proving impact is key: Automation helps validate vulnerabilities, even when they’re initially dismissed.
---
This success is a testament to the innovative problem-solving 🤓 and technical expertise 🔐 of F.Tech’s cybersecurity team. Have you ever used Python, Selenium, or similar tools in your cybersecurity journey? Let’s share experiences and learn together!
🚀 💰 🔒 🐍 🤖 ⚙️ 🔎 🕵️♂️
