Just a moment...
Imrane T. — Offensive Security | Attack Chains & Business Logic
Started with a JS credential leak.
Ended with:
cross-tenant payments + webhook interception.
Fintech APIs still break the same way:
auth is there, isolation isn’t.
Write-up (sanitized):
https://medium.com/@insid_e/how-i-chained-a-hardcoded-password-into-a-cross-merchant-payment-takeover-48294c608f03
3 reactions · 0 comments