# ZiCharge Full Data Dump Inventory — 2026-07-04

## S3 Buckets (25 total) — All Readable
| Bucket | Size (sample) | Content |
|--------|----------|---------|
| zicharge-v2-prod-secrets | 23,863 B | application-prod.yml, docker-compose.prod.yml, oauth-private.key, oauth-public.key |
| newroz-gitlab-backup | 545+ MB | 1000+ GitLab backup tars (14.2.3) with PostgreSQL dump |
| zicharge-monitoring-loki-production | 2.9+ MB | Production Loki log chunks |
| zicharge-monitoring-tempo-production | 260+ KB | Production distributed traces |
| zicharge-prod-cdn | 21 KB | CDN assets |
| zicharge-dev-cdn | 21 KB | Dev CDN assets |
| zicharge-prod-waf-accessloggingbucket | 6.5+ KB | WAF access logs |
| zicharge-prod-waf-log | 121 B | WAF config |
| aws-cloudtrail-logs-368586151120-192a | 10+ KB | CloudTrail audit logs |
| aws-cloudtrail-logs-368586151120-281b | 1.4+ KB | CloudTrail digest |
| sqs-logs-cloudtrail | 2.4+ KB | SQS CloudTrail |
| cw-syn-results-368586151120-eu-west-1 | 70+ KB | Canary synthetic monitoring |
| dizli-dev | 107+ KB | Dizli app attachments/photos |
| fastpayassets | 29+ KB | KYC document templates |
| fastpayiq | 15+ KB | Transaction HTML archives |
| dalkurd-cur | 93+ KB | AWS billing reports |
| tf-state-ngc | 31 KB | Terraform state (VPC infra) |
| tf-state-dalkurd | 156 B | Terraform state |
| tfstate-stored | 901 B | More Terraform state |
| assets.dalkurdff.app | 103 KB | Dalkurd FC app assets |
| dalkurdff.app | 17 KB | Dalkurd FC website |
| www.dalkurd.se | 1.3 MB | Dalkurd SE website |
| dalkurd.se | 0 B | Empty |
| zicharge-monitoring-loki | 182 KB | Staging Loki chunks |
| zicharge-monitoring-tempo | 1.1 MB | Staging traces |

## CloudWatch Log Groups (43 total) — All Readable
| Log Group | Size | Content |
|-----------|------|---------|
| /aws/rds/instance/zicharge-prod-db/general | **120.6 GB** | ALL production SQL queries with user data |
| /aws/rds/instance/zicharge-prod-db/slowquery | 328 MB | Slow queries |
| /aws/sqs/dev-zicharge | 7.3 GB | SQS queue logs |
| zicharge-ProdApplicationLog | 2.8 GB | Application logs |
| zicharge-ProdAccessLog | 1.9 GB | Access logs |
| /zicharge/v2/core/prod | 836 MB | Java app prod logs (sign-ins, OTPs, tokens) |
| /zicharge/v2/core/staging | 181 MB | Java app staging logs |
| dalkurd | 518 MB | Dalkurd app logs |
| zicharge-Prodsupervisordlog | 164 MB | Supervisord |
| zicharge-ProdSysLog | 107 MB | System logs |
| zicharge-dev-applicationlogs | 588 MB | Dev app logs |
| /aws/lambda/zicharge-health-checker | 19.7 MB | Health checker |
| /aws/lambda/zicharge-btr-latch-publisher | 2.2 MB | BTR publisher |
| zicharge-admin-panel-application-log | 2.7 MB | **Admin panel logs** |
| zicharge-merchant-panel-application-log | 241 KB | **Merchant panel logs** |

## Downloaded Files
| File | Size | Content |
|------|------|---------|
| application-prod.yml | 12,407 B | Full Spring Boot production config |
| docker-compose.prod.yml | 7,384 B | Full Docker Compose with ALL secrets in cleartext |
| oauth-private.key | 3,272 B | RSA 4096-bit private key for JWT signing |
| oauth-public.key | 800 B | RSA public key |
| gitlab_backup.tar | 552,960 B | GitLab backup with database dump |
| db/database.sql | 2,731,943 B | PostgreSQL dump of GitLab instance |

## GitLab Database (from S3 backup)
- 3 users: admin@example.com (root), me@sabbir.dev (Sabbir Ahmed), ghost@example.com
- bcrypt password hashes for admin and sabbir
- SSH key: ssh-ed25519 for me@sabbir.dev
- Admin has 2FA backup codes
- 1 project: "Monitoring" (self-monitoring)
- IP addresses: 103.87.212.202, 103.125.97.156 (Bangladesh)

## Production Database (via CloudWatch General Logs)
Tables confirmed:
- users (user_id 1000600000+ range, names, mobile numbers)
- block_lists (security blocks per action type)
- notifications
- oauth_access_tokens (token hashes)
- oauth_clients (client ID 142)
- trade_orders (P2P trading)
- trade_ads (buy/sell ads)
- trade_reviews
- thirdparty_request_logs (2.7M+ rows)

## Credentials Extracted
| Service | Credential | Source |
|---------|------------|-------|
| MySQL Production | appuser:z9RWsHeA@G6n!sB^8}xl | docker-compose.prod.yml |
| Twilio SMS | AC695c...:.76a34c... | docker-compose.prod.yml |
| FulgurPay | NdP6l8cSRY5P:Eeex0Ww0sPQp | docker-compose.prod.yml |
| Intercom | Bearer dG9rO...1OjA= | docker-compose.prod.yml |
| Pusher | 22dd66...:dcfee0... | docker-compose.prod.yml |
| Kartat API | zicharge@cardselling.cash:@G4PxZ79UP5^ | docker-compose.prod.yml |
| CardSelling | Token: Card@#$2022 | docker-compose.prod.yml |
| APP_KEY | base64:5N/TX0XeiCwPG70hRL7O4Q6RNcvLA4/ITENRZs3xSyk= | docker-compose.prod.yml |
| Static OTP | 223344 for +9647515269916 | application-prod.yml |
| AWS Admin Role | AdministratorAccess-Role/ashrafuzzaman@newroztech.com | WAF logs |
| Grafana users | anis@newroztech.com, mahfuz@newroztech.com, ruhul@newroztech.com | Grafana API |
| GitLab admin | admin@example.com ($2a$10$j3uA/Z...) | database.sql |
| GitLab sabbir | me@sabbir.dev ($2a$10$fl/.l/...) | database.sql |