How you can too…

Hi, I’m Antonio Rivera, a Security Researcher, Bug Hunter, and Ethical Hacker. I have secured some companies, received bounties, Hall of Fame mentions and recived Letters of Appreciation and Recognition.

🌌 Hacking NASA — A Journey Full of Challenges

Let me tell you — hacking NASA (ethically, of course!) isn’t something that happens overnight. This achievement was the result of continuous effort, learning, and bug hunting on their platform.

🔍 Now the Actual Thing: The Vulnerability I Found

I was prowling a subdomain something like vuln.nasa.gov poking at it the old-fashioned way: manual tests, small probes, looking for IDORs, CSTI, XSS and the usual suspects.

I clicked into a calendar form just to see what it would do. Nothing flashy: a date picker, a few fields, the kind of UI people build and forget about. I decided to be petty and inject the simplest thing possible a single-quote payload: ' Immediately, the site crashed.

Not a graceful error page, not a polite “something went wrong” an ugly Django traceback appeared. Debug mode was on. The stack trace spilled internal configuration and environment details that should never leave to the public.

In short, a development convenience had become an open door.

📅 Timeline of the Report

Submitted : 08 Apr 2025
Triaged: 13 Apr 2025
Resolved: 22 May 2025 ✅
LoR: 11 Jun 2025 🎉

The LOR😊:

How to do it: