How to Discover Unauthorized Access on Edu.cn Sites Using Hunter Queries

Using Hunter to Find Target Sites

I start with a Hunter.io query learned from the community: domain="edu.cn" && web.body="注册", which returns edu.cn domains that contain a registration page.

Why this query? Sites that expose a registration function often provide a login page that, once authenticated, reveals additional functional endpoints and higher‑privilege interfaces.

After logging in, the target site becomes accessible (see image). The testing mindset is to probe for common vulnerabilities: SQL injection points with echo output, XSS, file‑upload endpoints, framework‑specific generic flaws, and any logical weaknesses.

Although I did not find a concrete vulnerability at this stage, I continued with directory scanning using the teacher‑recommended findsomething plugin (see image). Each discovered asset or interface is examined individually.

During the scan I uncovered a path /advixxx that serves as a class‑teacher management backend. The endpoint lacks any authentication, allowing unauthenticated access to sensitive data such as financial transaction records (see image).

For this type of information leakage, I captured the request and response with Burp Suite, which often reveals additional data and further attack surfaces.

Unauthenticated access also exposed more hidden interfaces (see image). One of them is a WordPress‑based site administrator backend. I suggest running Kali’s wpscan tool against it, as it may uncover further vulnerabilities.

Source: 掌控安全EDU