> For the complete documentation index, see [llms.txt](https://everythingblackkk.gitbook.io/everythingblackkk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://everythingblackkk.gitbook.io/everythingblackkk/web-security/how-i-found-a-security-vulnerability-in-nasa.md).
# How I found a security vulnerability in NASA
Hey Everyone ,
Here’s another example of a vulnerability I found in **NASA**. This is actually my **third bug** with them, and honestly, it was a pretty fun one that also gave me a nice takeaway.
I started off by pulling subdomains using **Amass**. The tool gave me over **30,000 subdomains**.
```sh
amass enum -d nasa.gov -o nasa_domains.txt
```
I used **HTTPX** to filter out the active ones.
```sh
httpx -l nasa_domains.txt -status-code -mc 200 -silent -o live.txt
```
To make it easier, I split the results into chunks of **5,000 each** like this:
```sh
split -l 100 -d --additional-suffix=.txt nasa_domains.txt sub_
```
### Step 2 — AI Filtering
Here’s where AI really helped. There’s a cool tool that lets you run LLMs directly in your terminal using your **Gemini** or **OpenAI API key**.
So I asked the AI to analyze my subdomains and tell me which ones looked interesting, like internal dashboards, DevOps tools, staging environments, etc.
Example command:
```
cat subdomains.txt | llm -m gemini/gemini-2.5-pro "I have a list of subdomains from a target.
Please analyze it and identify any subdomains that might be related to internal infrastructure,
DevOps tools, staging environments, dashboards, or admin panels.
Look for signs of tools like Jenkins, GitLab, Grafana, Kibana, SonarQube, Prometheus, ArgoCD, Harbor, Portainer, etc."
```
The AI did a great job , it pointed out the subdomains most likely to hold sensitive stuff, saving me tons of time.\
Usually, these are the ones that have misconfigurations, info leaks, or outdated CVEs.
### **Step 3 — Digging Deeper**
From the filtered results, one of the subdomains I got was:
[`https://mcl-labcas.jpl.nasa.gov/labcas-ui/m/index.html`](https://mcl-labcas.jpl.nasa.gov/labcas-ui/m/index.html)
As always, my first move is checking **JavaScript files**, because they often reveal hidden endpoints or secrets that people overlook.
I used a little snippet to pull out endpoints from JS files:
```javascript
javascript:(function() {
var scripts = document.getElementsByTagName("script"),
regex = /(?<=("|'|%27|`))\/[a-zA-Z0-9_?&=\/\-.\\]*?(?=("|'|%60))/g,
results = new Set();
for (var i = 0; i < scripts.length; i++) {
var t = scripts[i].src ? fetch(scripts[i].src).then(t => t.text()).then(t => {
var e = t.matchAll(regex);
for (let r of e) results.add(r[0]);
}).catch(function(t) {
console.log("An error occurred: ", t);
}) : null;
}
var pageContent = document.documentElement.outerHTML,
matches = pageContent.matchAll(regex);
for (const match of matches) results.add(match[0]);
function writeResults() {
results.forEach(function(t) {
document.write(t + " ");
});
}
setTimeout(writeResults, 3e3);
})();
```
But honestly, I prefer **manual analysis**, so I opened the JS files myself.
### Step 4 — The Discovery
I noticed the developers were saving **way too much stuff in Local Storage**, which is usually a bad idea.
So I checked it out, and boom — there it was.
I found a hidden endpoint:
{% embed url="" %}
Visiting that link gave me access to **over 1,300 user records** from the platform.
Note: This site isn’t public. Regular users can’t even create accounts there, which makes the exposure more critical.
### Final Result
I reported the issue, and it was **accepted as a P3**.
And I Got Letters of Recognition (LOR) Criteria
### And I Got Letters of Recognition (LOR) Criteria
### Thank you all! I hope you enjoyed the article. If you have any questions, I’m here to help.
Remember My name : everythingBlackkk
Made by ❤
Github :
Linkedin : [www.linkedin.com/in/everythingblackkk](http://www.linkedin.com/in/everythingblackkk)
X :
Youtube :