During an OSINT engagement, we found a forgotten login page still pulling a JavaScript file. Inside: admin credentials in plain text. One file. Full production database access. The client’s reaction when we told them? “This wasn’t the first time.”
No remote code execution. No sophisticated exploits.
A login page that looked like it hadn’t been touched in years, and a JavaScript file nobody had cleaned up.
The page nobody maintained
During an Initial Access Broker OSINT engagement, a login page caught our attention. Not because of anything dramatic. It looked old. Forgotten. The kind of page a team inherits from whoever came before and never adds to the backlog.
We started watching the resources loading in the background. One JavaScript file stood out by name alone.
Inside: internal IP addresses, application logic comments, and the general impression that nobody had looked at this in a long time. The kind of careless that only builds up when everyone assumes someone else is checking.
The credentials that shouldn’t exist
We searched the file for a handful of keywords: role, login, url.
One function stood out. It contained a hardcoded username and password, sitting in plain text, in 2026.
The credentials worked.
Which means admin access: rights over a customer base in the hundreds of thousands, and full production database access.
The response that said everything
When we raised the finding, the client’s response landed harder than the exploit itself.
“This wasn’t the first time.”
“This was supposed to be behind the firewall.”
The login page hadn’t been updated in years. Nobody was watching it, because everyone assumed it already sat behind the firewall.
That assumption was wrong.
The boring parts are where you lose
Methodology is everything.
Check the obvious. Test what your team assumed was already fixed. Poke at the corners everyone assumed were covered, especially the tedious ones nobody wants to look at.
Attackers don’t skip the boring parts. They rely on the fact that you did.
Forgotten or deprecated assets usually fall outside the asset inventory and the regular scan scope. Nobody retests them. That’s exactly why they accumulate risk silently.
A forgotten login page and a careless JavaScript file handed us one of the largest access footprints of the entire engagement.
Nobody had looked at it in years. That was the vulnerability.
The consequence is direct: access at this scale typically means an attacker can exfiltrate the full customer dataset, alter records, or pivot into connected systems.
When that data includes personal information, it usually triggers breach-notification obligations under regulations like GDPR. Worse, one overlooked file can create real regulatory exposure.
Unleash the Swarm. We’ll map every forgotten corner of your attack surface before someone else does.