800 Euros Bounty | Admin Panel Bypass | H&M | Bug Bounty

Hello Everyone,
The Admin Panel Bypass POC has just been released.
Credit:
👤 Kartik Singh
🌐 LinkedIn: / kartik00013
📷 Instagram: kartik_00013?ig...
What is Admin Panel Bypass:
An "admin panel bypass" typically refers to a security vulnerability or exploit in a web application that allows an attacker to gain unauthorized access to the administrative panel or control panel of a website, application, or system. This is a serious security issue as it could lead to unauthorized manipulation of the system, exposure of sensitive information, or even complete compromise of the application.
The term "admin panel bypass" encompasses various techniques that attackers might use to circumvent the authentication and authorization mechanisms of an admin panel. Some of these techniques include:
Brute Force Attacks: Attackers attempt to guess the correct username and password combinations through automated scripts or tools.
SQL Injection: If the admin panel uses a database to store user credentials, attackers might exploit vulnerabilities in the application's input validation to execute malicious SQL queries, potentially revealing login information.
Cross-Site Scripting (XSS): If the admin panel has vulnerabilities that allow for the injection of malicious scripts into the page, attackers can steal session cookies or credentials from administrators.
Session Hijacking: Attackers might capture valid session tokens or cookies to impersonate an authenticated administrator.
Directory Traversal: Exploiting improperly sanitized inputs to navigate to restricted directories or files and access sensitive data or functionality.
Security Misconfigurations: Poorly configured security settings could inadvertently provide unauthorized access to the admin panel.
Default Credentials: Some systems come with default usernames and passwords for admin access, which attackers might exploit if not changed.
Authentication Bypass: Exploiting vulnerabilities in the authentication process to bypass login screens altogether.
Admin panel bypasses can lead to severe consequences, including data breaches, unauthorized changes to system settings, defacement of websites, or even complete system compromise. To prevent such attacks, developers and administrators need to follow best practices for secure coding, authentication, authorization, and regular security audits. It's also crucial to promptly patch and update software to address any known vulnerabilities.

[@PP-km8uh]

can you explain what you did actually? i can see only you loggedin admin panel. where is bypass.

[@steiner254]

Great finding

[@shilpagyashrivas460]

Good work.

[@UCyohViaSVeHd2drDZVK2noQ]

so the register option was enable and anyone can register and access the admin panel. Nice finding

[@ISaIGoI]

😂

[@pwn16]

PII ??

[@devrajdhiwar9028]

Bro how to find this type subdomains ? Using permutation or other technique

[@Eirikrrrr]

mmm maybe : Amass (CLI) , CRTsh, WaybackMachine

[@whetfaartz6685]

Even after watching the video I still feel like I don't understand quite well, what exactly did he do in order to get the admin bypass?

[@Eirikrrrr]

I thought the same thing, I think I have something to do with the hidden domain admin-co.cosreller and the password reset
pero weno mas o menos se entiende

[@rahulchadda8962]

any proof of bounty

[@ByteBloggerBase]

Please check this link: www.linkedin.com/posts/kartik00013_cybersecurity-ethicalhacking-bugbounty-activity-6940201683616423936-JOG1?

[@AtenaCxv]

this minimum bug was 5000 dollars

[@muhammadidrisalfadany6512]

2000 dolar depending on the size of the prize given

[@user-jr4sg4vm8z]

congrats, can you share email compony I will send to him another bug from side

[@404_not_found_0]

hello brother i need small help will you help me