A Typo Got Me $100 Bug Bounty
Tags: security
Published: 2022-10-24 13:45:11

---
title: A Typo Got Me $100 Bug Bounty
published: true
date: 2021-10-25 03:22:19 UTC
tags: security
canonical_url: http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html
---

#### Introduction

On a lazy evening, while on a call with a friend, I made a typo while entering the url. Instead of typing [http://app-00421.on-aptible.com](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html), I typed [http://app-00412.on-aptible.com](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html)<sup id="fnref:aptible"><a href="http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fn:aptible">1</a></sup>.

In this article, lets see how this typing mistake got me a bug bounty.

#### Vulnerability

A [bug bounty program](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html)<sup id="fnref:bb"><a href="http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fn:bb">2</a></sup> is a deal offered by companies by which individuals can receive recognition and compensation for reporting bugs, security exploits and vulnerabilities.

Aptible provides HIPAA<sup id="fnref:hipaa"><a href="http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fn:hipaa">3</a></sup> compliant PAAS platform so that healthcare companies can deploy their apps without compliance hassle.

After deploying an application on aptible, users can create an endpoint for public access. For this purpose, atpible generates domain names in sequential order.

Due to this, a set of publicly exposed servers will have incremental domain names. A lot of companies use these sequentially generated domain names for staging & testing purposes. In general, many companies don't bother about implementing security best practices on non-production servers.

When I was trying to access a demo site at [http://app-00421.on-aptible.com](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html), I made a typo and visited [http://app-00412.on-aptible.com](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html). This site was a staging site of some other company without any authentication. The company's source code, AWS keys and a lot of sensitive information was publicly accessible.

I quickly sent an email to that company regarding this issue and they took their site offline. As per [Aptible disclosure policy](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html)<sup id="fnref:disclosure"><a href="http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fn:disclosure">4</a></sup>, this bug is out of scope. However I sent an email to their team regarding the severity of the issue. Since sequential domain names are generating additional target surface for attackers, I suggested to move to random urls.

For this disclosure, they have provided a bounty of 100$ and Aptible decided to move away from sequential domain names.

* * *

1. URL has been changed for anonymity. [↩](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fnref:aptible "Jump back to footnote 1 in the text")

2. [https://en.wikipedia.org/wiki/Bug\_bounty\_program](https://en.wikipedia.org/wiki/Bug_bounty_program) [↩](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fnref:bb "Jump back to footnote 2 in the text")

3. [HIPAA - Wikipedia](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act) [↩](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fnref:hipaa "Jump back to footnote 3 in the text")

4. [https://www.aptible.com/legal/responsible-disclosure/](https://www.aptible.com/legal/responsible-disclosure/) [↩](http://avilpage.com/2021/10/typo-lead-to-bug-bounty.html#fnref:disclosure "Jump back to footnote 4 in the text")