[Orcinusorca]

Greetings to all of you, haha. It’s us again, Orcinus Orca.Bruh, back to our scheduled data leak program :D
As I mentioned before, Visa was my next target, and bruh, you already know why I'm up here.
What we’re leaking includes:
Header name: XSRF-TOKEN-B2BIAM-HEADER
Token extracted from: document.body.children["XSRF-TOKEN-B2BIAM-FORM"]?.value
CSRF token names: XSRF-TOKEN-B2BIAM-COOKIE (cookie), XSRF-TOKEN-B2BIAM-FORM (hidden form), XSRF-TOKEN-B2BIAM-HEADER
HTTP 200 with content-type: application/json
Response: {"statusCode":"500","redirect":"NONE","correlationID":"..."}
BIGipServer~Extranet_Business~B2BIAM-Login
Internal server identifiers:
s: GP73_002 / s: OCE PR04
b2bam-agent-jwt and b2bamtokenp cookies — JWT auth tokensR1={production:!0,api_base:""}
N_={production:!1,api_base:"https://localhost:44375/login/"} — DEVELOPMENT CONFIG EXPOSED IN PRODUCTION BUILD!
API endpoints: authenticate, changePassword, verify, verifyUser, createPassword, recoverUserName, getEmpFedSsoConfig, getEmpAccessResources, sessionInfo, pdInfo, etc.
SSO endpoints: getEmpFedSsoConfig, getEmpAccessResources — Enterprise SSO config!
Registration URL: https://see.visaonline.com/register/The /common/whiteLabel endpoint returns JSON with:App ID: GVOL (internal app identifier)
Internal URLs: https://see.visaonline.com/, https://secure.visaonline.com/, self-service path
From email address: [email protected]
Feature flags: vbaRiskAnalysis: true, enableUpdateEmailAddress: true, passkey config, SSO enabled
Password validation regex patterns leaked
Version info: 2602.1, casVersion: v3
GTM tracking ID: GTM-KFRWK7B
Internal issuer: http://auth-service.gmap:9000
Token endpoint: http://auth-service.gmap:9000/oauth/token
Grant types: authorization_code, client_credentials, refresh_token, device_code, token-exchange
Token endpoint auth methods: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt
Dev Config in Production — N_={production:!1, api_base:"https://localhost:44375/login/"} + complete API route map (D1 object)
JTWtoken:eyJraWQiOiJoczI1Ni1rZXkiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJjbGllbnQxIiwiYXVkIjoiY2xpZW50MSIsIm5iZiI6MTc4MTMzOTcyNSwiYXpwIjoiY2xpZW50MSIsInNjb3BlIjpbIkNPTlRBQ1RfVVNfRk9STV9SVyIsIk1JR1JBVEVfVVNFUl9BV1MiLCJvcGVuaWQiLCJCQU5LX1BST0ZJTEVfUiIsIlZDRVNfVkFMSURBVElPTiIsIlJFVk9LRV9UT0tFTiIsIk9GRkVSU19SIiwiU0lURV9DT05GSUdfUiIsIlVTRVItQVRUUklCVVRFU19SVyIsIlVTRVJfUlciLCJVU0VSX1JFR0lTVFJBVElPTiJdLCJhbGxvd2VkX3NpdGVzIjpbIioiXSwiaXNzIjoiaHR0cDovL2F1dGgtc2VydmljZS5nbWFwOjkwMDAiLCJleHAiOjE3ODEzNDA2MjUsImlhdCI6MTc4MTMzOTcyNSwianRpIjoiYzMyYzdhYzMtMWE5Ny00OWNjLTgyOGYtZTBjODQ5MjcyODcwIiwiY2xpZW50X2lkIjoiY2xpZW50MSJ9.Uo6IcjeV_UFoEvg_FL-
usa.visa.com /gateway/api/account/me -> Session cookie containing JWT
JWT contains: iss: http://auth-service.gmap:9000 (internal K8s URL), allowed_sites: ["*"], client_id: "client1"
Sensitive Scopes: BANK_PROFILE_R, VCES_VALIDATION, USER_RW, MIGRATE_USER_AWS, REVOKE_TOKEN
198.80.42.4, 208.243.116.71
Check the proof below for more on the infra takeover bruh :DHey, do you know why I didn't use a 0-day like the previous targets?
Why? Huh, because this was just too easy.

There, see? And I have even more for the next round lol bruh. Next target is Office365 bruh :D
Good luck to them and secure it well :D