company of the week: united airlines

United Airlines runs a public Vulnerability Disclosure Program on Bugcrowd — a disclosure program, not a paid bounty, but one that puts United's public web surface in scope for outside research. neobotnet's full index is in /urls.

The scope is two roots. united.com is the airline you book flights on. ual.com is the other airline — the employee one, where a single "Flying Together" login stands in front of the entire staff back office.

read from dns: two roots, two airlines

Public DNS hands you the shape of the company before a single page loads. United's two apex domains split the work cleanly — one is the customer, the other is the workforce:

united  ·  2 in-scope roots  ·  one brand, two airlines
│
├─ ual.com ......... 843 names ....... the employee airline (the org chart in hostnames)
│                    │
│                    ├─ hr / benefits vendors, each a named third party united runs
│                    │    401k · benefits · schwab · mercer · concur · aon
│                    │    mentorcliq · seismic · bynder · servicenow
│                    │    schedulesource · pilotpbs · myidtravel
│                    │
│                    └─ remote access + identity, the way in and the who-are-you
│                         signon · login ........ oracle access manager (mints sso sessions)
│                         united-login · dmznam .. netiq access manager
│                         connectctx · resctx · remotectx · airbridge · resvdi · tulvdi
│                                                 citrix netscaler aaa (the employee vpn)
│                         mdmconsole ............ vmware airwatch (mobile-device management)
│                         idmadmin · artifactorycloud .. identity admin · jfrog artifact repo
│                         crl · crl2 ............ united's own pki revocation responders
│
└─ united.com ...... 765 names ....... the customer + corporate site
                     careers · cardmembers · rewardsplus (mileageplus)
                     apihub · atmos (design system) · ir (investor relations)
                     pilothiring · cars

The org chart is the hostnames. You don't need a page to load — the name tells an outsider which internal system exists and what it does:

• 401k, schwab, mercer — the payroll, stock-plan and benefits vendors United hands its staff to
• mdmconsole — the console that manages employee phones
• connectctx, airbridge — the gateways an employee dials home through

Read as a list, it is a target list: the vendor to phish, the gateway to spray, the identity system to study — all before anyone tries a password.

The non-production estate is out in the open too. dev (78 names), qa (85), staging (79), preprod (45) and uat (13) all resolve publicly. A staging host on the open internet is the softer copy of production, reachable by an outsider and usually patched a beat behind the real thing.

browse the dns layer in /dns →

read from http: one login in front of everything

144 hosts answer with a live page, and one title drowns out the rest. neobotnet pulls the page title off every host that returns HTTP 200 — and 26 of them answer with the identical United: Flying Together Login, all served by Oracle-HTTP-Server. One front door, dozens of rooms:

ual.com live surface  ·  90 live hosts  ·  26 answer the same login
│
├─ "United: Flying Together Login"  (Oracle-HTTP-Server, ×26)
│     signon.ual.com ......... the sso gate itself
│     401k.ual.com ........... retirement plan
│     benefits.ual.com ....... benefits portal
│     concur.ual.com ......... travel + expense
│     schwab.ual.com ......... stock plan
│     mercer.ual.com ......... benefits broker
│     servicenow.ual.com ..... it service desk
│     seismic.ual.com ........ sales enablement
│     myidtravel.ual.com ..... staff standby travel
│     schedulesource.ual.com . shift scheduling
│
├─ "NetScaler AAA"  (Apache, ×4) ..... airbridge · remotectx · resvdi   (the citrix vpn gate)
│
└─ other named systems
      artifactorycloud.ual.com → "JFrog"      mdmconsole.ual.com → "Login" (AirWatch)
      pilotpbs.ual.com → "Bidding App"        crl.ual.com → "IIS Windows Server"

This is an SSO monoculture — single sign-on, one login that gates many separate services. One front door, many rooms: locate the door and every internal app is one credential away. That is the whole blast radius of ual.com in a sentence — 26 systems sharing one gate, plus four more behind the Citrix VPN.

united.com's 54 live hosts read like a customer site:

• careers.united.com — Careers at United Airlines
• cardmembers.united.com — United MileagePlus Cards | Home
• apihub.united.com — Log in | United API Hub
• ir.united.com — Investor Relations

Two carry confirmed-live misconfigurations. z0x-prd-pc-s1-origin.mileageplustravel.united.com returns Google Cloud Run's default Congratulations placeholder — a production origin reachable directly, with the CDN in front of it bypassed. ualaki-salesinsight.united.com serves a Microsoft-IIS Default Page — a parked, un-provisioned host. Both answer 200; neither is a break-in, but both are loose ends. Across the 144 live hosts neobotnet fingerprints 83 distinct technologies.

see the live pages in /probes →

read from the urls: the archive tells on the company

Every crawled URL is filtered by what it serves — its content_type, the label the server puts on the bytes — not by the file name in the path. On Bolt that lens turned up 744 customer invoices. On United it returns zero PDFs by content-type (application/pdf = 0), against 4,696 text/html. United's disclosures aren't a live document store; they're shape preserved in the public web archive — 10,867 historical URLs that a crawler recorded years ago. Ranked the way a researcher would work them:

1 — the internal document tree, readable from outside, locked on the inside. The employee intranet (flyingtogether.ual.com, ft.ual.com) and PeopleSoft payroll (peoplesoft.ual.com) keep every document behind the Oracle/NetIQ login — but the paths sit in the public archive. neobotnet holds 18 of them: HR forms (W2-step-by-step-instructions.pdf, Registering_a_domestic_partner.pdf), pass-travel guides, inflight-scheduling award lists, ground-safety docs, a payroll pay-advice (UAPAYADV.pdf). Every one returns status 0 — the door is locked. The disclosure isn't the file; it's the map of what United files where, and the exact URL to request the day a credential turns up.

see the internal document paths in /urls →

2 — the shapes an attacker would test first. Three, all archived, none confirmed reachable — signal, not verdict. (a) An admin endpoint with sequential integer ids: qualityfirst.ual.com/Admin/FoodInvestigations/EditClaim?claimId=<n>, where the archive holds 8156, 8846, 9240. Sequential ids on an Admin edit page are the classic broken-access-control shape — does record 8155 belong to someone else? (b) Analytics dashboard paths on devspotfire.ual.com (TIBCO Spotfire) whose file names embed an employee's full name and internal U-number — neobotnet keeps the shape and prints neither. (c) A password-reset link on etaadmin.ual.com that carries its reset token in the URL (?mailResetPwd=<blob>) — a reset link travels wherever URLs travel. All three answer status 0, so each is an archived shape to probe, not a confirmed hole.

see the archived admin endpoint in /urls →

3 — a token that is its own key. Five URLs on click.enews.united.com/subscription_center.aspx carry a JSON Web Token in a jwt= parameter — a signed-not-encrypted token, so anyone holding the URL reads the payload. These are Salesforce Marketing Cloud subscription-center links: the token names an email subscriber (a business-unit id plus a per-recipient subscriber id) and loads that person's email preferences with no login. The link is the credential. Unlike the rest, these answer 200 and carry no expiry claim — so this is the one to treat as signal, not verdict, and the right destination is United's disclosure program, not a blog post. neobotnet keeps no token and no subscriber id.

see the subscription-center tokens in /urls →

Now walk the loud alarms back — the discipline is the point. The index flags 73 "credential in url" hits; read the values and all 73 are password=secure_string, the literal placeholder inside United's Oracle Access Manager login-form template. Zero real passwords. The archive holds mail.ual.com/wp-config.php.bak, /wp-config.php.zip, /app/etc/local.xml.bak and Oracle XSQLConfig.xml — 46 URLs that read like a catastrophic config leak. Every one returns status 0, and mail.ual.com never answered a live probe. These are vulnerability-scanner requests the public archive recorded years ago, not files that exist. A URL in an archive is a question someone asked, not an answer the server gave. And the 98 "same-domain redirect" hits are challenge_url, resource_url, returnurl and target — the return-to-after-login parameters of the SSO flow, not open redirects.

what it adds up to

United's estate ranks cleanly for a researcher working the program:

1. the SSO front door — one login owns dozens of internal apps; find its weakness and the blast radius is everything behind it.
2. the vendor + access map — DNS names every HR vendor, VPN gateway and identity system to target, before a single request.
3. the archive's document tree — the internal filesystem, pre-mapped, waiting on a credential.
4. the subscription-center tokens — the one live "link is the credential" item, disclosure-channel first.

Two things stated plainly, the way this series always closes. Every item above is a signal, not a confirmed vulnerability — neobotnet surfaces the shape; confirming exploitability is the researcher's job. And the right destination for anything live is United's disclosure program, not a blog post.

next week

neobotnet runs the same pass on a different in-scope program every week. Subscribe via RSS or browse the company of the week archive.