WHO Hall of Fame: when recon finds /env

This one didn't need anything fancy. It started with basic recon and a hunch.

Recon

$ subfinder -d who.int

I went through the discovered subdomains one by one. One admin-portal host caught my attention. No clever reason, just instinct that it was worth digging into.

Enumeration

Most of the visible features weren't interesting, so I started gobuster in the background and kept exploring by hand. It helped that no WAF or CDN was getting in the way of enumeration.

$ /env    (Status: 200)

Not .env — just env. Luckily my wordlist contained that entry. The endpoint exposed database configuration details that should never have been public.

Disclosure

I reported it to the WHO security team. They fixed the issue and listed me in the WHO Vulnerability Hall of Fame.

Takeaways

• Go wide before going deep: enumerate every subdomain, then follow the one that looks out of place.
• Wordlists decide what you find. env without the dot was the hit here.
• Note what sits in front of a target. No WAF meant enumeration ran cleanly.
• Report quickly and keep the details private until the fix is in.