Domains, Callbacks, Tokens and Exploits

The talk follows a private bug bounty engagement against an unnamed company, told as a story from first discovery to payout. An automated scan flagged an unusual request to a subdomain. Checking the history showed the parent domain had expired, so the researcher re-registered it and set up wildcard DNS and a web server to record incoming requests. The callbacks carried bearer tokens and basic authentication headers tied to a Rancher Fleet agent.

The company first dismissed the finding as a forgotten development site, then asked the researcher to keep going. The researcher hypothesised that nodes did not re-check which management server they were talking to, so their workloads could be changed. Early attempts failed, and much time went into learning Rancher and Kubernetes and rebuilding the lab. Eventually the agent was pointed at a new server, scripts rewrote URLs and tokens on the fly, and command execution on real nodes followed. The containers reached internal networks, and a root mount of the host filesystem showed how loose the container security settings were.

The closing part covers the bounty and the lessons drawn. Persistence, careful documentation and not assuming which software is calling home all mattered. For defenders, expired domains that still point at old services, rapid response to alerts, and separating development from production networks stand out. The speaker also argues that clear two-way communication between triagers and researchers gives both sides a better outcome.