https://blog.s4yhii.com/tags/information-disclosure/ Recent content in Information Disclosure on s4yhii's blog https://blog.s4yhii.com/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://blog.s4yhii.com/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Tue, 06 Oct 2026 08:00:00 -0500 https://blog.s4yhii.com/posts/rds-sibling-enumeration-nxdomain/ Tue, 06 Oct 2026 08:00:00 -0500 https://blog.s4yhii.com/posts/rds-sibling-enumeration-nxdomain/ <h2 id="disclaimer">Disclaimer</h2> <p>Reported to the affected company, one of the main banks in Chile, and since mitigated. The screenshots are real captures with hostnames, credentials, addresses and personal data blurred out. Identifiers in the text are placeholders. Validation was read only.</p> <hr> <h2 id="introduction">Introduction</h2> <p>On 30 September we pulled a production MySQL password out of a 500 page on a bank&rsquo;s rewards site. The host it named didn&rsquo;t resolve, so the credential looked dead on arrival. It wasn&rsquo;t. The part of an RDS hostname shared by every instance in the same account and Region led us to a sibling: same password, still working, full admin over 428,068 identity records.</p>