How I made the United Nations Hall of Fame in 3 minutes | by Renganathan | Jun, 2021

ByPR 24
Renganathan

Hi There,

Renganathan here.

This Write-up is about how I made the United Nations hall of fame in 3 minutes.

And this is my first write-up / Blog on Medium.

Ps- I don’t know to use Medium.

I saw there was a vulnerability reporting program on United Nations (UN) so I decided to give it a try.

So just like any other hacker, I enumerated the subdomains of un.org but using virustotal.com

Yes, Sorry 🙁

I was not at home, I was in a restaurant. So I used my phone to enumerate subdomains with virustotal.com

I was giving a glance through the subdomains and one of them was git.unite.un.org. I clicked on that.

The plot twist was there was no authentication.

Then I was able to access so many source codes, drupal configurations, their projects (not opensource), and even credentials. I reported them immediately to infosec@un.org

TimeLine:

Dec 4, 2020- Reported
Dec 5, 2020- Case Number Assigned (Auto-generated email)

No update *crying_noise.mp3*

Jan 13, 2021- The bug was resolved and an authentication page was added. I was asked how my name has to appear on the page If I would like to get credit.

Jan 19, 2021- Name was updated in the hall of fame

Edit: I had a poor internet connection, So it took me 3 minutes. For you it will be 30 Seconds 😛

Thanks for reading 🙂
Stay Safe!

Similar Posts

Investigation uncovers global abuse of Pegasus malware to spy on journalists, activists and more

Investigation uncovers global abuse of Pegasus malware to spy on journalists, activists and more

ByPR 24

Spyware produce by the Israeli surveillance firm NSO Group has been abused by governments to target dissenting journalists, activists, lawyers and more, an investigation by human rights groups and media organizations has found. The Pegasus spyware was produced with the intention of targeting terrorists and other criminals, but an investigation into a huge data leak…

This New Malware Family Using CLFS Log Files to Avoid Detection

This New Malware Family Using CLFS Log Files to Avoid Detection

ByPR 24

Cybersecurity researchers have disclosed details about a new malware family that relies on the Common Log File System (CLFS) to hide a second-stage payload in registry transaction files in an attempt to evade detection mechanisms. FireEye’s Mandiant Advanced Practices team, which made the discovery, dubbed the malware PRIVATELOG, and its installer, STASHLOG. Specifics about the…

Botnet Data Leak: 26 Million Passwords Exposed

Botnet Data Leak: 26 Million Passwords Exposed

ByPR 24

Cybercrime , Data Loss Prevention (DLP) , Endpoint Security 1.5 Million Facebook Passwords Among Leaked Data; Raccoon Infostealer Suspected Jeremy Kirk (jeremy_kirk) • June 10, 2021     A control panel for the Raccoon infostealer botnet, where subscribers can browse data stolen from compromised computers (Source: Hold Security) There’s such a surfeit of stolen data…

Researchers Uncover New Android Banking Malware

Researchers Uncover New Android Banking Malware

ByPR 24

Account Takeover Fraud , Cybercrime , Cybercrime as-a-service Threatfabric Says Vultur uses Screen Recording to Target Victims Akshaya Asokan (asokan_akshaya) • July 31, 2021     Vultur is spread disguised as a legitimate app in Google Play Store. (Source: Google Play) A newly uncovered banking Trojan dubbed “Vultur” is targeting Android users through screen recording…

Verkada’s Camera Debacle Traces to Publicly Exposed Server

Verkada’s Camera Debacle Traces to Publicly Exposed Server

ByPR 24

Endpoint Security , Governance & Risk Management , Internet of Things Security ‘Arson Cat’ Hacker Tillie Kottmann Says She’s Not Worried About Law Enforcement Jeremy Kirk (jeremy_kirk) • March 12, 2021     Photo: Verkada Tales of unsecure IoT cameras come along with regularity. But it’s going to be tough to top the system-wide failure…

Unpatched Flaw in Linux Pling Store Apps Could Lead to Supply-Chain Attacks

Unpatched Flaw in Linux Pling Store Apps Could Lead to Supply-Chain Attacks

ByPR 24

Cybersecurity researchers have disclosed a critical unpatched vulnerability affecting Pling-based free and open-source software (FOSS) marketplaces for Linux platform that could be potentially abused to stage supply-chain attacks and achieve remote code execution (RCE). “Linux marketplaces that are based on the Pling platform are vulnerable to a wormable [cross-site scripting] with potential for a supply-chain…