How I Turned a 403 Error into a $200 API Key Leak Bounty
嗯，用户让我帮忙总结一篇文章的内容，控制在100字以内，而且不需要用“文章内容总结”之类的开头。我得先仔细看看这篇文章讲的是什么。 文章标题是关于如何将一个403错误转化为泄露Supabase密钥，获得了200美元的赏金。作者Jeet Pal详细描述了他在测试目标时发现了这个漏洞的过程。他用了SecLists和ffuf工具来 fuzz 域名，找到了一个隐藏目录，里面暴露了Supabase密钥，然后报告了这个漏洞，最终得到了赏金。 我需要把重点放在发现过程、使用的工具、结果以及赏金上。同时要确保语言简洁明了，控制在100字以内。避免使用复杂的术语，让读者一目了然。 可能的结构是：作者通过测试发现403错误，使用工具找到隐藏目录，暴露密钥并获得赏金。这样既涵盖了主要步骤，又简洁有力。 最后检查一下字数是否符合要求，确保没有遗漏关键信息。 </think> 作者通过测试发现了一个403错误，并利用SecLists和ffuf工具发现了一个隐藏目录，从中获取了Supabase密钥并获得200美元赏金。 2025-12-15 08:34:18 Author: infosecwriteups.com(查看原文) 阅读量:6 收藏

JEETPAL

Hello everyone,

Get JEETPAL’s stories in your inbox

Join Medium for free to get updates from this writer.

Today I’ll explain how I turned a 403 error into a $200 Supabase key leak

This is a detailed breakdown of the same finding I shared on LinkedIn: https://www.linkedin.com/posts/jeet-pal-22601a290_bugbounty-activity-7395416068464254976-DqA8

I had been testing the target for 5–6 days and had already reported multiple business logic and BAC issues. When I finished the main scope, I rechecked the domains to see if anything new appeared. One endpoint that previously returned a 500 error was now showing a 403, which caught my attention.

Press enter or click to view image in full size

I decided to test it further and started fuzzing the domain using SecLists

ffuf -w seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://stage.mpc.Example.com/FUZZ

I found a directory named demo-test-engine. Its page source contained an exposed Supabase key. I reported it, and after validation, the team fixed the issue and awarded a bounty.

Press enter or click to view image in full size

Fixed

Press enter or click to view image in full size

Bounty

Connect with me
LinkedIn: https://www.linkedin.com/in/jeet-pal-22601a290/
Instagram: https://www.instagram.com/jeetpal.2007/
X/Twitter: https://x.com/Mr_mars_hacker

If you want to exchange program DM me on LinkedIn

Join a community of 3,300+ security researchers on our Discord server, where we discuss Web3 vulnerabilities, audits, and much more! 🚀
👉 Join the server here: https://discord.gg/Y467qAFM4X


文章来源: https://infosecwriteups.com/how-i-turned-a-403-error-into-a-200-api-key-leak-bounty-96faba78dfc4?source=rss----7b722bfd1b8d--bug_bounty
如有侵权请联系:admin#unsafe.sh