Login with leaked credentials (But how to find the leaked credentials of the specific company 🤔? ) - How to get the plain text passwords of the company

You have enumerated subdomains and you have come acrossed admin panels. You tried brute forcing credentials from public sources but no success.

What should you do now ?

You need to check the breached credentials of the specific company.

which site you need to check ?
dehashed.com

Goto dehashed.com give the query domain:company.com

If there is any breaches happend in the past it shows you the credentials of the company

To download them you need to have a active subscription

They charge 7$ for week + you need to buy the api query credits

i.e 3$ for 100 api queries

You need to have both of them to use the api from the bash using the apikey

Query goes like

curl 'https://api.dehashed.com/search?query=domain:"company.com"'

-u dehashed-registerd-email@mail.com:api-key -H 'Accept: application/json'

Get The Data from the above queries.

You can also use jq for processing the json output from the above liner.