DEV Community: Mughunthen

I Found Open Directory Listing Exposing .env, .git, and Database Backups in mail.adkcompany.com

Mughunthen — Mon, 21 Sep 2026 08:09:28 +0000

How Subfinder + Gobuster Led Me to Sensitive Files — Responsible Disclosure
Author: Mughunthen | Security Researcher — Neyveli

Disclaimer
This vulnerability was found on mail.adkcompany.com. The issue was responsibly disclosed to CERT-IN and ADK Company. All sensitive file contents are NOT disclosed or exposed. This writeup is strictly for educational purposes following complete redaction.

Introduction
Vanakkam! I'm Mughunthen. During my recon on adkcompany.com, I found an interesting subdomain mail.adkcompany.com that had directory listing enabled, exposing critical files like .env, .git, composer.json, and backup archives.

Recon — Subdomain Enumeration
I started with Subfinder:

subfinder -d adkcompany.com -o subdomains.txt

Result: Found 26 subdomains including:

mail.adkcompany.com

shop.gannamart.com

adkpharma.adkcompany.com

adkgroup.net

My focus shifted immediately to mail.adkcompany.com because mail server endpoints often suffer from web server misconfigurations.

Directory Bruteforcing with Gobuster
Bash
gobuster dir -u https://mail.adkcompany.com/ -w /usr/share/wordlists/dirb/common.txt
Findings:

[Status: 200] /database/

[Status: 200] /public/

[Status: 200] /vendor/

[Status: 301] /.git/

[Status: 403] /.env

Multiple sensitive directories returned HTTP 200/301 status codes, which was an immediate red flag.

The Main Bug — Index of /
When navigating to [https://mail.adkcompany.com/] the server returned a standard Index of / directory listing page:

Index of /

Name
adk-general-trading.xml
adkcompany.zip (38M)
artisan
bootstrap/
cgi-bin/
composer.json
config/
database/
...
.git/HEAD
.htpasswd

This is an Open Directory Listing vulnerability. The server has Options +Indexes explicitly enabled.

An attacker could potentially access:

adkcompany.zip — Full source code backup (38MB)

.git/ — Full Git repository history and commit logs

composer.json / composer.lock — Application dependency details

database/ — Database schema/backup directories

Impact
Source Code Disclosure: The 38MB zip file leaks core application logic.

Secrets Leak: Git history and configuration endpoints can expose database credentials, SMTP parameters, and API keys.

OWASP Classification: A01:2021 — Broken Access Control.

Exposure of administrative credentials could allow Remote Code Execution (RCE).

Steps to Reproduce (Safe)
Navigate to [https://mail.adkcompany.com/]

Observe the rendered Index of / page.

Confirm directory listing is enabled and sensitive path structures are visible.

Stop enumeration and proceed directly to reporting without downloading sensitive assets.

For the ADK Company Security & Infrastructure Team:

Disable Directory Listing: In Apache, set Options -Indexes in your main configuration or .htaccess file.

Remove Archival Backups: Remove public archives like adkcompany.zip from webroot.

Restrict Access Rules: Block .git, .env, and dependency files at the web server level (Nginx/Apache).

Isolate Sensitive Folders: Move database/ and core application code outside the public HTTP webroot.

Aug 17, 2026: Vulnerability identified during recon.

Aug 18, 2026: Reported Maldives government help desk

Sep 21, 2026: Published sanitized educational writeup after redaction.

About Me
Mughunthen — Bug Bounty Hunter from Neyveli. Passionate about reconnaissance, attack surface mapping, and directory enumeration.

Follow me on Medium for more technical bug bounty writeups and CERT-IN disclosure stories!

I Found an OTP Bypass in The Kari Kadai App That Leaks User Tokens

Mughunthen — Mon, 21 Sep 2026 06:58:31 +0000

How a simple login API was returning auth tokens before OTP verification — and how I reported it to CERT-IN.
By Mughunthen — Security Researcher | Neyveli

I am Mughunthen, a security researcher from Neyveli.

While casually testing a local food delivery app — The Kari Kadai — for security vulnerabilities, I stumbled upon a severe flaw in their authentication flow. I never expected a simple login request to leak sensitive session tokens outright.

The Vulnerability
Found by: Mughunthen
Endpoint: POST /user/login

Vulnerable Response
{
"status": "SUCCESS",
"message": "OTP has been sent to your mobile",
"data": {
"id": "[REDACTED]",
"user_type": "USER",
"mobile_number": "[REDACTED]",
"auth_token": "[REDACTED]",
"activation_token": "[REDACTED]"
}
}

The Issue: The server generates and returns the sensitive auth_token immediately in the initial request response — before the user inputs or verifies the OTP. Anyone with a targeted user's mobile number can intercept this response and completely bypass the OTP verification mechanism.

Impact & Mitigation
Impact
Account Takeover (ATO): Attackers can gain full access to any user account just by knowing their phone number.

PII Leakage: Exposed tokens grant access to user profile details, order history, and saved addresses.

Broken Authentication: Invalidates the security purpose of 2FA/OTP.

Recommended Fix
Generate and issue the auth_token only after the user successfully validates the OTP on a separate verification endpoint (/user/verify-otp).

Status: Reported to CERT-In / Pending Fix

About Me
Mughunthen — Bug Bounty Hunter | CERT-IN Reporter

How I Found an Unauthenticated Admin Panel Leading to Potential RCE at Sun TV Network HRMS (CERT-In Acknowledged)

Mughunthen — Mon, 21 Sep 2026 06:28:33 +0000

Introduction
Hello security community! I am Mughunthen K, an independent security researcher from Neyveli

This writeup details a critical security vulnerability—an Unauthenticated Admin Panel in Sun TV Network's HRMS portal that posed a risk of Remote Code Execution (RCE).

Reconnaissance & Subdomain Discovery
Target: [https://hrms.sunnetwork.in/]

While conducting surface reconnaissance on sunnetwork.in, I identified hrms.sunnetwork.in, an internal Human Resource Management System portal.

Step 1: Directory Fuzzing
To discover unlinked or hidden paths, I ran directory brute-forcing:

Bash
gobuster dir -u https://hrms.sunnetwork.in/ -w directory-list-2.3-medium.txt -k

Results:

/Admin.aspx (Status: 200) [Size: 34671]
/ADMIN.ASPX (Status: 200)
/access.aspx (Status: 200)
/billing.aspx (Status: 200)
/app/ (Status: 301)
/scripts/ (Status: 301)
The endpoint /Admin.aspx returned a 200 OK status code instead of a expected 302 Redirect to a login interface.

Technical Details & Impact
Step 2: Accessing the Panel
Navigating directly to https://hrms.sunnetwork.in/Admin.aspx loaded an administrative panel with no authentication challenge.

Exposed Interface Capabilities:

Interface Title: Administrative / Media Upload Manager

Functional Input Fields:

Title field

Thumbnail File Upload (Choose File)

URL / File Attachment Upload (Choose File)

Video Player / Category dropdown

Submission Handler

The interface exposed direct file-upload functionality publicly without verifying active session tokens or user roles and files like .aspx are uploaded directly into a publicly or internally accessible web server path (flv/), an attacker can upload a web shell or malicious script. Once navigated to, the server processes the file, enabling remote code execution on the backend IIS server under the service account context.

Step 3: Attack Scenario (Potential RCE)
Without authentication restrictions, the panel exposed the application to potential arbitrary file uploads:

Unrestricted Upload: An attacker could attempt to upload a custom ASPX web shell (e.g., shell.aspx).

Execution Path: If file extension validation or MIME-type filtering was missing, the file would be stored in a web-accessible directory such as /uploads/ or /app/.

Remote Code Execution: Accessing the uploaded file path ([https://hrms.sunnetwork.in/uploads/shell.aspx] could execute server-side code under the context of the web application user.

Note on Responsible Disclosure: No arbitrary code execution files or malicious payloads were uploaded during this research. Upon confirming the exposure of the functional endpoint, testing was halted immediately to adhere to ethical testing guidelines.

Impact Assessment
Severity: Critical (CVSS v3.1: 9.8)

Access Vector: Network (Unauthenticated)

Impact Areas: Confidentiality, Integrity, and Availability

Risk Context: Threat actors could compromise internal HR data or deface external web resources.

Remediation & Defensive Recommendations
Enforce Authentication Middleware: Verify active administrative session state prior to processing routes for /Admin.aspx. If non-authenticated, redirect to the centralized authentication route.

Strict File Extension Whitelisting: Validate uploaded files against a strict whitelist (e.g., .jpg, .png, .mp4). Explicitly reject executable server-side extensions (.aspx, .asp, .php, .exe).

Storage Isolation: Store uploaded media outside the web root directory or on an isolated static content bucket (e.g., AWS S3) with execution permissions disabled (No-Exec).

Implement Role-Based Access Control (RBAC): Restrict access control based on user privileges.

Code Fix Example (C# ASP.NET)

protected void Page_Load(object sender, EventArgs e)
{
if (Session["UserRole"] == null || Session["UserRole"].ToString() != "Administrator")
{
Response.Redirect("~/Login.aspx", true);
}
}
Disclosure Timeline
August 27, 2026: Vulnerability identified during routine research.

August 27, 2026: Submitted detailed report and PoC to CERT-In.

August 29, 2026: CERT-In acknowledged the vulnerability and notified the Sun TV Network security team.

August 30, 2026: Remediation deployed by Sun TV Network team (Access to /Admin.aspx now correctly enforces authentication).

Key Takeaways for Security Researchers
Always check case-sensitivity variations during endpoint discovery (/Admin.aspx vs /admin.aspx).

IIS / Windows environments treat URLs as case-insensitive, but underlying authentication filters or custom routing rules occasionally fail to normalize uppercase variants.

Written by Mughunthen K | Independent Cybersecurity Researcher