bribes

Break into any Microsoft building: Leaking PII in Microsoft Guest Check-In _{^{(All Buildings + Guest/Employee PII)}}

Date: 07/18/25

Hey! I'm Faav, a 15 y/o amateur bug bounty hunter and this is my first write-up! So this is the story of how I figured out how to leak PII in Microsoft Guest Check-In.

One day I was poking around random Microsoft subdomains when I stumbled upon guest.microsoft.com.

zeroc0d3

Install

# Install dependencies
sudo yum install -y java-1.8.0-openjdk screen

# Create a new unprivileged user for minecraft
useradd -r -m -d /opt/minecraft minecraft

# Create the directory that will house our minecraft instances

sudo su --shell /bin/bash minecraft

kawaii

upstream mybb {
    server mybb:9000 weight=5;
}

server {
    listen 80;
 
    root /var/www/html;
    index index.html index.php;

munim

Start a stopped docker container in bash/shell interactive mode

For instance, you have just pulled a CentOS or Ubuntu image using docker pull centos:latest or docker pull ubuntu:latest.

Your immediate command would be

# docker run -it centos:latest
# docker ps -a

adamgen

Africa/Abidjan
Africa/Accra
Africa/Addis_Ababa
Africa/Algiers
Africa/Asmara
Africa/Bamako
Africa/Bangui
Africa/Banjul
Africa/Bissau
Africa/Blantyre

tstout

package db.io

databaseChangeLog {

//
//  Liquibase column types. Oddly enough, these are not mentioned in the docs, these were obtained from the source.
//
//    "BIGINT"
//    "NUMBER || "NUMERIC"
//    "BLOB"