An interesting idor that allowed me to See all projects ($$$$ Bounty)

Hi all today i will share an intresting i dor that i found in a one of hackerone private programs that allowed me to disclose all users private projects without there permission : )

intorduction:

it was a normal day as anyday and i get an invite from a private program so i said why dont i take a look on it so i grab a cup of coffee and enter the website and start testing it as a normal user

I made a project and make it private one then i decide to open project link in private browser and that was result

I notice that it wasnt found but before that i notice that its uploaded on main website, so i keep thinking about what to do next and i decide to go deeper and check some subdomains.

Tio: just because main domain is secure that dosent mean subdomains are also secure : )

After checking few subdomains i notice one of them that contain same login page of the main website so i directly try to login with same credinals i used in the main websites and i was surprised that i was logged in so that mean another chance for idor :D

I go to one of projects and that was result

Still didnt opened so I opened it in a new page and here was the surprise:

Its uploaded in another subdomain like that: uploads.target.com/get_image/project/577213875_282x210.png

Its clear now that i have to change project id and thats what i did and surprise was that it worked and it taked me to another user project but i wasnt clear if it disclose private projects, so i go to private browser and put my private project id that i created in first time when i opened in the main website and i was able to view it even without login.

I reported that and that was result:

Accepted rewarded and resolved as critical but i didnt stop here i keep going more deeper and i was able to get another subdomain with another function that allowed me to do same thing and i could double my bounty

I hope this article was clear and hope it gonna help some of you follow me on twitter if you want more https://twitter.com/hamzadzworm