Read for Freee..ee.e

🐺Hunters,

I was hunting on my primary payment app back in January 2025 and at that time I don’t know have much knowledge of recon, so I started with very basic thing. As you read this blogs you’ll know how this discovery leads to a big discovery.

Basic Recon

I started with selecting a subdomain of my target and I started with very simple recon tool waybackurls to get the history of my targeted subdomain:

waybackurls subdomain.com | anew waybacksubs.txt

From waybackurls data I got a lot of .png, .jpeg, .js files and broken directories.

I started clicking those image files and broken links to get sensitive directories and any unauthorized page.

After sometime, I realized this subdomain is only used for storing static files.

Sensitive Directories

I started with general sensitive directories which includes:

admin,documents,logs,private

Now I started with target specific sensitive directories which includes:

report,payment,transaction,merchant