How I Got a P3 in NASA · ProjectMerai

Hello researchers, In this article I’ll share my journey of getting LOR from NASA. I’ll keep this article as beginner friendly as I can. Let’s begin.

batman begins

At first, same like every researcher out there I did some common subdomain enumeration, for NASA I used subfinder, BBOT, assetfinder and findomain. after that I ran dnsx for resolved domains and httpx for the URLs. I usually don’t run nuclei on URLs right after httpx but I manually test them one by one and only run nuclei on the target which I find interesting. I tested them one by one, got some surface level knowledge of how NASA is handeling things on web. After a bit research on couple of subdomains I found Self-XSS and DNS SSRF, all marked as Informational P5.

After weeks, I still did not had a valid finding just a bunch of P5s and NAs or Out-of-Scope (which was valid but not for NASA). The findings till yet was helpful but it was really stressing me out. I took a few days break to start with a fresh mind again.

batlight shines

I started again after few days. I chose a domain redacted.nasa.gov. I saw that the website has a login functionality, I registered an account, I logged in and edited my profile a bit while capturing it with Burp proxy to inspect those requests later. After that, I went to HTTP History section of Burp and saw all the requests and response of the actions I just did. I saw that the register, login and the editing requests are being sent with GET request which is a solid red flag. All the data is being trasmitted using parameters to that GET request.

For example,

GET /login?username=test?password=test

Usually when I find something like this I test for CSRF, I captured a request of Email change through the edit profile section and created a CSRF POC through Burp. I copied the URL through burp and ran it on a new browser window with changed email.

To the people who don’t know how this works, heres the flow: I Captured the Email change request for example,

GET /editprofile?email=test@test.com?confirm_email=test@test.com
Host: redacted.nasa.gov

In Burp pro, there is a feature to create a POC for CSRF, basically it will give you the HTML code for the exploitation that you can execute in your browser. for example,

<html>
<body>
<img src=”https://redacted.nasa.gov/editprofile?email=hacked@hacked.com&confirm_email=hacked@hacked.com" />
</body>
</html>

When you run that HTML page with changed Email in a new browser window, the Email gets changed to hacked@hacked.com, confirming CSRF vulnerability.

After running it into the new window, I checked my Email on the profile page and BOOM the Email changes. I couldn’t believe I found CSRF in NASA! But unfortunately this bug was a duplicate.

from Bugcrowd

Now this one hurt real bad. I got demotivated and gave up on NASA. At this point there was no point of me going back, like I did find a valid vulnerability but there is no proof that I did.

its just the rain

While I was learning the way of recon from the king - Jason Haddix, there was one thing he said about the world of bug bounty is that “Do not get attached to a bug”. There will be a lot of times when we feel that the bug deserves more and you didn’t get the deserving reward for it and its totally okay and the best path is to accept the loss and move to the next bug.

Keeping that in mind, after few weeks I got back at it again with high motivation and a big break. Again one domain at a time, while researching I found that on subdomain redacted2.nasa.gov I can access raw REST API responses. Now this is not vulnerable by default but this kind of things may have hidden endpoints or an exposed endpoints that might reveal sensitive information.

for example, https://redacted2.nasa.gov/rest/api/content/[page] > Raw API Responses

Now here, there was a page that revealed many users’ API keys, usernames, their real names and many sensitive information. I reported it, It got triaged, assigned P3 and now it is resolved.

so now when we try to acccess [page] it returns 403. https://redacted2.nasa.gov/rest/api/content/[page] > 403 Forbbiden

the endpoint after fix

Timeline,

Submitted: 25 Jun 2025 12:12:01 UTC Triaged: 25 Jun 2025 19:51:17 UTC Accepted by NASA: 27 Jun 2025 14:58:45 UTC Resolved/Fixed: 06 Aug 2025 15:39:29 UTC Disclosed: 07 Aug 2025 15:52:50 UTC Link: https://bugcrowd.com/disclosures/73ce2fb6-25c8-40f8-b3fa-e553427d63fb/user-information-disclosure-via-exposed-api-endpoint

and yes, the LOR:

The LOR for ghostvirus

So, yes this is what I did to get that LOR from NASA. It definitely wasn’t easy to get it but a journey that is worth the trouble, I learned a lot through this about web applications, and how we have to change our methodology according to the target.

You can follow me on, github: https://github.com/ghostvirus62 LinkedIn: https://www.linkedin.com/in/ghostvirus/

onto saving more of gotham

BYE BYE!!