During an OSINT engagement, we found a forgotten login page still pulling a JavaScript file. Inside: admin credentials in plain text. One file. Full production database access. The client's reaction when we told them? "This wasn't the first time."
No remote code execution. No sophisticated exploits.
Just a login page that looked like it hadn’t been touched in years, and a JavaScript file that really should have been cleaned up.
During an Initial Access Broker OSINT engagement, a login page caught our attention. Not because of anything dramatic. It just looked old. Forgotten. The kind of page that gets quietly inherited by whoever comes next and never quite makes it onto the backlog.
We started watching the resources loading in the background. One JavaScript file stood out by name alone.
Inside: internal IP addresses, application logic comments, and the general impression that nobody had looked at this in a long time. The kind of careless that only builds up when everyone assumes someone else is checking.
We searched the file for a handful of keywords: role, login, url.
One function stood out. It contained a hardcoded username and password, sitting in plain text, in 2026.
The credentials worked.
Admin access. Rights over 300,000 accounts and 190,000 entities. Essentially the full production database.
When we raised the finding, the client’s response landed harder than the exploit itself.
“This wasn’t the first time.”
“This was supposed to be behind the firewall.”
Someone had probably looked at this before and found nothing. The assumption was that it was protected, so nobody kept checking.
That assumption was wrong.
Methodology is everything.
Check the obvious. Test the things that should have been fixed. Poke at the stuff everyone assumed was already covered,especially the tedious corners nobody wants to look at.
Attackers don’t skip the boring parts. They rely on the fact that you did.
A forgotten login page and a careless JavaScript file handed us one of the largest access footprints of the entire engagement.
Nobody had looked at it in years. That was the vulnerability.
Unleash the Swarm and find out what’s sitting quietly in your forgotten corners.