Hello, a friend who lives in India was the target of an online fraud recently. I've been trying to think of ways the attack might have been orchestrated. I was hoping that some the security experts here might chime in on what may have happened.

Before going into the details of what happened, for those that aren't familiar, online transactions in India use OTPs (for One-Time Password). When a user makes an online transaction, they receive a unique, temporary code that is valid for a short period of time. The user must enter this code to complete the transaction. OTPs are typically sent to the user's registered mobile number via SMS. The message that contains the OTP also has information re. the transaction - the amount, etc.

DETAILS OF THE FRAUD

1. My friend was using a iPad with up-to-date security updates. He uses Safari as his browser.

2. My friend wanted to purchase tickets to an exhibition so he googled the exhibition's website.

3. On the website, there was a link (this is no longer available since the exhibition ended) to purchase tickets. https://indiaartfestival.com/

4. Clicking on the link opened a page on a very popular ticketing website (similar to Ticketmaster in the U.S.). https://in.bookmyshow.com/explore/home/national-capital-region-ncr

5. My friend entered his credit cards details and clicked on 'Purchase'. I'm guessing this was via a payment gateway the ticketing website uses.

6. He received an OTP via text message and entered it on the site.

7. The site displayed an error message saying that there was some problem with the transaction and that a new OTP was being sent. Note that he did not do anything to get the new OTP, it was sent automatically.

8. My friend recd. the 2nd OTP and entered that. His mistake was that he did not check the rest of the text message which contained the amount of the transaction, etc.

9. The site displayed an error message again and sent another OTP.

10. My friend entered the OTP for the 3rd time. He made the same mistake and did not check the rest of the message.

11. He doesn't remember what exactly happened after this but there were no more OTPs sent to his phone.

12. Instead of 1 transaction, his credit card had been charged 3 times:

a) A valid transaction for the tickets he was trying to purchase.

b) 2 fraudulent transactions, each for about 50 times the price of the tickets.

He's opened a dispute with his credit card company but I'm curious how was this done. The ticketing website (and I'm guessing the payment gateways they use) are pretty big in India and if it was compromised and a lot of people were defrauded, I would've expected to hear something in the news. Haven't heard anything.

I got him to check his browser history and there were only 3 sites he opened when this happened:

1. Google when he searched for the exhibition's website.

2. The exhibition website.

3. The ticketing website.

We confirmed that 2 & 3 above were legit sites and not something set up for a phishing attack.

I've discussed this with a couple of my tech friends (no one specializing in security though) and none of us have been able to come up with a reasonable explanation of what may have happened. Any security gurus have any thoughts? Thank you!

I'm also CS graduate(2023). I'm looking to contribute in open research opportunities. If you are a masters/PhD/Professor/ enthusiast, would be happy to connect.

I need to find out if the code they want me to run contains any vulnerabilities or malware. This is typically for an interview.

I know the basics of web development and I have just begun my learning in Web security. I’m following the Web Application Hackers Handbook. What can I do so that I gain hands-on experience?

I have a very basic question to ask regarding the web-security.

I have asked this question bcoz I have seen so many things that you can do while you are working with a local server over http:// protocol but such features ain't available with the file:/// scheme (directly opening an HTML file into a browser with file:/// scheme). I know, such features are restricted over file:/// scheme due to security vulnerabilities.

Assume that someone is accessing his HTML webpage locally using file:/// protocol and he is not using a local server to access or view an HTML webpage, then how allowing many features of https:// protocol to a file:/// scheme as well can introduce security vulnerabilities?

I already tried to ask chatgpt but didn't get any practical examples that make sense.

Plz, can someone explain it with some examples?

Hi everyone,

I hope you're all doing well!

I wanted to share a tool that could be very useful for those of you building web and mobile applications, especially when it comes to securing your APIs.

We all know that the security aspect of most websites is often under-tested. Attackers can bypass the UI and call APIs directly, extracting more information than intended and discovering business logic vulnerabilities.

What if you could remove your APIs and source code from the attackers' landscape entirely? Codesealer does just that with end-to-end API encryption. By concealing all API endpoints behind an opaque /x endpoint and encrypting all API requests beyond TLS, it prevents request forgery and manipulation.

And all this without any code changes on your side. Sounds cool?

I'd love to hear your thoughts on this approach.

Just released pphack, a CLI tool for scanning websites for client-side prototype pollution vulnerabilities.

• Fast (concurrent workers)
• Default payload covers a lot of cases
• Payload and Javascript customization
• Proxy-friendly
• Support output in a file
• Rate-limit supported

Try it at https://github.com/edoardottt/pphack.

If you want to provide any feedback or you have doubts just open an issue :)

If we are not logged in to any web page, then what all test cases can we perform for pentesting process?

If anyone here is interested in code review based testing then you should check out the Patchstack bug bounty program, which pays bounties for vulnerabilities found in any WordPress plugins (more than 60K in WP.org repo).

There are guaranteed bounties that are paid out each month based on research score and just for November alone they set up over $4000 USD for those who report new vulnerabilities. There are also individual bounties for specific vulnerability types, etc.

I think it’s a great way to get started with bug hunting and maybe earn your first $ and CVE. Patchstack itself btw also assigns CVEs (is one of the biggest CVE assigner in the world). It could also be a good change for the more seasoned bug bounty hunters who have been doing blackbox testing and want to try something different and more in the direction of whitebox / code review.

The recent event announcement: https://x.com/patchstackapp/status/1723241552997159145

The bounty program website: https://patchstack.com/alliance/

There is also an active discord community where most of the info is posted: https://discord.gg/Xe2T5JjKbn