{"uuid": "3fe3e5ff-be77-4e22-9d7e-9ff7022d2613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "seen", "source": "https://t.me/hacking_Attack/161216", "content": "My Journey to NASA\u2019s Hall of Fame\n\nHi, I\u2019m Dharineesh, AKA Hack-Bat, and this is the story of how I ended up being listed in the NASA Hall of Fame. It wasn\u2019t a smooth ride. The path was filled with long nights, false hopes, and a lot of second-guessing. But every time I stumbled, I asked myself a simple question: \u201cstay down or get up\u201d \u2014 and I got back up. Here\u2019s how things unfolded.Phase 1: Google Dorking I began with what a lot of bug hunters do: Google Dorking. It\u2019s like looking for needles in a haystack using smart magnets \u2014 crafting specific search queries to find misconfigurations, exposed credentials, and more. I spent days digging through public directories, login portals, and possible leaked documents. Some of it looked promising. But when I submitted those finds, they came back as \u201cNot Applicable\u201d. That happened not once, not twice, but five times in a row. At that point, I was frustrated. But something in me said: You\u2019ve made it this far. Keep going.Phase 2: The Game-Changer \u2014 CVE-2025\u20134123 That\u2019s when I came across a fresh CVE \u2014 CVE-2025\u20134123 \u2014 tied to Grafana, it is an open-source web application used for analytics and interactive data visualization. It\u2019s widely used for monitoring application performance, visualizing metrics, and configuring alerts. The vulnerability allowed attackers to:Redirect users through open redirect flawsPull off SSRF attacks to query internal servicesTrigger account takeover using XSS This was a big deal. Now I just had to find an exposed Grafana instance. Simple in theory, a grind in reality.Phase 3: The Subdomain Hunt This is where things got messy \u2014 in a good way. Finding Grafana meant doing massive subdomain enumeration. I couldn\u2019t rely on just one tool. Here\u2019s the combo that worked:subfinder -d example.com curl -s \"https://crt.sh/?q=%25.example.com\" | grep -oP \"(a-zA-Z0-9_-+\\.)+example\\.com\" | sort -u assetfinder --subs-only example.com findomain -t example.com I extracted the top three-level subdomains using the below command:awk -F. '{n=NF; if(n>=3) print $(n-2)\".\"$(n-1)\".\"$n; else print $0}' subdomain.txt | sort -u > top3_subdomains.txt Then performed subdomain enumeration on each of them using the tools mentioned above. I merged the results and filtered them through httpx to see which ones were alive:cat final_subdomain.txt | httpx -ports 80,443,8080,8000,8888 -threads 200Phase 4: Found It Eventually, I found a couple of suspicious-looking Grafana panels. I took the known payload for CVE-2025\u20134123 and crafted this URL:https://grafana.x.y.example.com/public/..%2F%5cevil.com%2F%3f%2F..%2F.. I opened the link, waited for a second \u2014 and it redirected. This was it. The vulnerability was real, and it was exploitable.What I Learned Some takeaways that might help others:Enumeration is more than just running a tool. Mix and match methods.Fresh CVEs are goldmines \u2014 if you move early.Don\u2019t stop at rejection. Analyze why it failed, adjust, and retry.Always document your process \u2014 clean, reproducible reports are key.Referenceshttps://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53Wrapping Up Bug hunting isn\u2019t about luck. It\u2019s about persistence, timing, and understanding systems deeply. Not everything you find will be useful \u2014 but every failed attempt sharpens your instincts.\u201cDon\u2019t aim for the trophy. Aim for the process. The trophy will follow.\u201d \u2014 Hack-Bat My Journey to NASA\u2019s Hall of Fame was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-02T01:00:40.099205Z"}