How Subfinder + Gobuster Led Me to Sensitive Files — Responsible Disclosure
Author: Mughunthen | Security Researcher — Neyveli
Disclaimer
This vulnerability was found on mail.adkcompany.com. The issue was responsibly disclosed to CERT-IN and ADK Company. All sensitive file contents are NOT disclosed or exposed. This writeup is strictly for educational purposes following complete redaction.
Introduction
Vanakkam! I'm Mughunthen. During my recon on adkcompany.com, I found an interesting subdomain mail.adkcompany.com that had directory listing enabled, exposing critical files like .env, .git, composer.json, and backup archives.
Recon — Subdomain Enumeration
I started with Subfinder:
subfinder -d adkcompany.com -o subdomains.txt
Result: Found 26 subdomains including:
mail.adkcompany.com
shop.gannamart.com
adkpharma.adkcompany.com
adkgroup.net
My focus shifted immediately to mail.adkcompany.com because mail server endpoints often suffer from web server misconfigurations.
Directory Bruteforcing with Gobuster
Bash
gobuster dir -u https://mail.adkcompany.com/ -w /usr/share/wordlists/dirb/common.txt
Findings:
[Status: 200] /database/
[Status: 200] /public/
[Status: 200] /vendor/
[Status: 301] /.git/
[Status: 403] /.env
Multiple sensitive directories returned HTTP 200/301 status codes, which was an immediate red flag.
The Main Bug — Index of /
When navigating to [https://mail.adkcompany.com/] the server returned a standard Index of / directory listing page:
Index of /
Name
adk-general-trading.xml
adkcompany.zip (38M)
artisan
bootstrap/
cgi-bin/
composer.json
config/
database/
...
.git/HEAD
.htpasswd
This is an Open Directory Listing vulnerability. The server has Options +Indexes explicitly enabled.
An attacker could potentially access:
adkcompany.zip — Full source code backup (38MB)
.git/ — Full Git repository history and commit logs
composer.json / composer.lock — Application dependency details
database/ — Database schema/backup directories
Impact
Source Code Disclosure: The 38MB zip file leaks core application logic.
Secrets Leak: Git history and configuration endpoints can expose database credentials, SMTP parameters, and API keys.
OWASP Classification: A01:2021 — Broken Access Control.
Exposure of administrative credentials could allow Remote Code Execution (RCE).
Steps to Reproduce (Safe)
Navigate to [https://mail.adkcompany.com/]
Observe the rendered Index of / page.
Confirm directory listing is enabled and sensitive path structures are visible.
Stop enumeration and proceed directly to reporting without downloading sensitive assets.
For the ADK Company Security & Infrastructure Team:
Disable Directory Listing: In Apache, set Options -Indexes in your main configuration or .htaccess file.
Remove Archival Backups: Remove public archives like adkcompany.zip from webroot.
Restrict Access Rules: Block .git, .env, and dependency files at the web server level (Nginx/Apache).
Isolate Sensitive Folders: Move database/ and core application code outside the public HTTP webroot.
Aug 17, 2026: Vulnerability identified during recon.
Aug 18, 2026: Reported Maldives government help desk
Sep 21, 2026: Published sanitized educational writeup after redaction.
About Me
Mughunthen — Bug Bounty Hunter from Neyveli. Passionate about reconnaissance, attack surface mapping, and directory enumeration.
Follow me on Medium for more technical bug bounty writeups and CERT-IN disclosure stories!
Top comments (0)