‘I Scanned 100,000+ Subdomains For CVE-2025-29927

Summary: The video discusses a critical vulnerability that affects numerous apps and companies, highlighting a comprehensive process of discovering and exploiting this vulnerability across over 100,000 subdomains. The presenter shares insights on their scanning setup, exploitation strategies, and the different scenarios encountered during the hunt, revealing that even large companies with robust security teams can remain vulnerable.

Keypoints:

• The investigation began by scanning over 100,000 private bug bounty subdomains for vulnerabilities.
• Despite possessing extensive security budgets, many large companies were still found to be vulnerable.
• A scanning pipeline was built using SubFinder and Axium to automate the discovery and verification of vulnerabilities.
• Used a detection methodology that involves sending specific requests to identify potential targets.
• Exploitation involved custom payloads to bypass various security measures across different apps.
• Automation was crucial, supplemented by an organized screenshot process to identify vulnerable dashboards easily.
• Discovered multiple exploitation scenarios, including authentication bypass and API manipulation.
• Learned that understanding the core workings of the application is essential for successful exploitation.
• Web application firewalls should not be solely relied upon for security as they can provide a false sense of security.
• Next.js is prevalent, but it poses unique challenges for bug bounty hunting, emphasizing the need for a deeper understanding of its architecture.