First Step: In first, i found my subdomain using Amass tool. After i used ffuf tool for brute force the directories and i found an Improper access control: https://subdomain.xxx.com/phppgadmin There was a page with need to submit credentials, user and password. I tried some combination of user/password with googling, and thanks to…