You can instruct "MySejahtera" to spam OTP to others at will. Just run the following code at terminal of choice and change contact number (Window user pandai pandai tukar la )

Go ahead and try, the URL is legit anyways. Can use Postman or other tools as well, as long as you send that form-data, it works. These mistake are worse than interns lol.

They kinda forget to verify the captcha actually. They have Captcha at the page, but backend doesn't verify that token.

There are no rate limit, meaning you can repeatedly keep on request OTP with a simple scripts.

Triggering OTP is not the issue, the issue is lack of Authentication/Authorization token. Maybe that's the implementor have the same thought as you.

Also, the OTP token never change, at least for the past 19 hours that i had been spamming myself.

This post has been edited by Darkripper: Oct 18 2021, 02:16 PM

They can't do that, as that's the endpoint that client side is calling to trigger it. Eaiest way is just to rate limit + some kind of Captcha. That would reduce the exposure to an acceptable limit.

It wont solve all, but it reduces the exposure.

Cost is not the question here. This is a critical app required by most residents in Malaysia, cannot compromise on security yo. Imagine a data-breach?


I see you're man of culture here. Jquery hurts my eye tho.

tweeted, still no news yet. So yeah

Btw seems like the dev is fixing, some of the other exploits is getting patched. But still doesn't give much confidence when they don't acknowledge it.

This post has been edited by Darkripper: Oct 18 2021, 02:40 PM

Good to do it for free, the issue is on Govt for not ensuring quality in such a critical application. Devs are probably getting squeezed also la.

you're talking about their backend implementation, which is out-of-reach. Client trigger mysejahtera, which in turn they forward it to provider. It doesn't matter how the backend is implemented if they open their doors wide open.

PM me their number lor. Its a curl command, you can try it for yourself. Its pretty much copy paste run.

Its time had passed.

jquery is top go-to library when everyone is manually manipulating HTML elements for frontend, it is easier to use than vanilla JS. It is not bad, just it is not that relevant anymore.

Then SPA like Angular, React comes along, which is easier to code, a little bit more structured and efficient. The best thing about SPA is there is less page refresh, providing a better UX.

Now you even have Vue, Svelte, SolidJS which is trying to overtake React.

Its not just for UI, but for client-side aka frontend to render and do whatever it needs to (communicate with server, service worker to run some shit in the background)

This post has been edited by Darkripper: Oct 19 2021, 02:52 AM

What?

aiya, they say its a feature that get exposed. lel... *FEATURE*.

Btw they haven't fix yet also, just add reCAPTCHA, which can be solved using API also