1c:I[73356,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogArticleEnhancements"] 1d:I[53721,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogViewTracker"] 1f:I[97042,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogToc"] 24:I[54324,[],"IconMark"] :HL["https://codelivly.com/wp-content/uploads/2023/02/login-1203603_1280.jpg","image"] 20:T24a6,

Hello, fellow Bug Hunters! It’s me again Jefferson Gonzales, and in this article, I’ll tell you about how I got my dream Dutch Government SWAG, and without wasting your time let’s get started.

On May last year 2021, I noticed that many Bug Hunters had posted on Twitter and LinkedIn that they had received swag from the Dutch Government, I saw the T-Shirt, which was so awesome and had a print saying “I hacked the Dutch government and all I got was this lousy t-shirt,” and I wanted to wear that t-shirt as well, so I searched for a list of Dutch Government domains and found it on github.

https://raw.githubusercontent.com/mil1200/NCSC-NL/27312c1088b3a271289b29407212689afa9dd116/NCSC-NL-subdomains.txt

I manually checked all of that domain for two weeks and all I got is a Static Website and I didn’t found any bugs, so I need to find a good target that is not a Static Website, after checking manually I found a target which is number 1043 on the list

The first I did is to use waybackurls so I can collect all the hidden parameters, and when my waybackurls done scanning I found an interesting parameter that was reflected on the web page

The value of the parameter ?photographer= was reflected on the page, to test if it’s possible for XSS I add a value Gonz”> to ?photographer= and it was reflected without sanitizing the symbols

Final Payload:

https://www.nederlandsesoorten.nl/linnaeus_ng/app/views/search/nsr_search_pictures.php?photographer="><script>alert(document.cookie)</script>

Open Redirect to XSS

While waiting for the fix on the above report I hunt again and I found another latest dutch government website list, you can download it below

https://www.communicatierijk.nl/binaries/communicatierijk/documenten/publicaties/2016/05/26/websiteregister/websiteregister-rijksoverheid-2022-01-27.ods

After I downloaded and looking for a new target I found a good one

nictiz.nl

Since in the main domain there’s no any juicy endpoint I scan the subdomain using the tool called Sublist3r and I found an interesting one

terminologie.nictiz.nl

The thing that caught my attention is there’s a Login but there’s no Signup or Register

I tried a default user/pass

admin:admin
admin:admin123
demo:demo

When I try the demo:demo credential I redirected into the dashboard, but inside the Dashboard of a Demo privilege user there’s no interesting functions since you can’t edit or modify any content it’s like it’s the same as user without authentication

But using the demo credential I found an open redirect vulnerability

https://terminologie.nictiz.nl/art-decor/login?returnToUrl=//google.com

but I need to escalate this bug to a better vulnerability so it will be qualified to their Vulnerability Disclosure Program.

I used the below payload to escalate into XSS

Payload: javascript:alert(1)

So when I click the below link and login using the demo credential the XSS will be executed

https://terminologie.nictiz.nl/art-decor/login?returnToUrl=javascript:alert(document.cookie)

CSRF to Account Takeover

My third target was

repository.scp.nl

It has a big scope to hunt since there’s a Login and Register, first I created an account and then login

When I update my name I found out that there’s no CSRF Token implemented so I can modify any users name with CSRF attack, but this is not a critical bug since I can only modify the name

I need to find a way to make it a serious bug, so I looked through all of the features and discovered the change password feature, which allows me to change my password without having to enter the old one.

I immediately generated a CSRF POC using Burp Suite CSRF Generator, tested it on my second account, and it successfully changed the password on my second account.

Report Responses

1st Bug:
Submitted Date: May 3, 2021
Resolved Date: September 16, 2021

2nd Bug:
Submitted Date: August 15, 2021
Resolved Date: September 21, 2021

3rd Bug:
Submitted Date: August 17, 2021
Resolved Date: October 1, 2021

After a month, my swag still hasn’t arrived, so I go to my local post office and pick it up myself.

Thank you for reading this writeup.

You can contact me on

Twitter: @gonzxph

LinkedIn: @gonzxph

9:[["$","$L1c",null,{}],["$","$L1d",null,{"slug":"my-experience-on-hacking-the-dutch-government"}],"$L1e",["$","div",null,{"className":"mx-auto max-w-6xl px-4 py-10 sm:px-6 sm:py-12","children":["$","div",null,{"className":"lg:grid lg:grid-cols-[minmax(0,1fr)_320px] lg:gap-10 xl:gap-12","children":[["$","article",null,{"id":"blog-content","className":"blog-content min-w-0 max-w-3xl","children":[["$","nav",null,{"className":"font-mono mb-6 text-xs text-[var(--hm-muted)]","children":[["$","$L1a",null,{"href":"/","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Home"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","$L1a",null,{"href":"/blog","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Blog"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"My Experience on Hacking the Dutch Government"}]]}],["$","header",null,{"className":"mb-8","children":[["$","div",null,{"className":"mb-6 overflow-hidden rounded-[2px] border border-[var(--hm-border)]","children":["$","img",null,{"src":"https://codelivly.com/wp-content/uploads/2023/02/login-1203603_1280.jpg","alt":"My Experience on Hacking the Dutch Government","className":"aspect-[16/9] w-full object-cover"}]}],["$","div",null,{"className":"mb-4 flex flex-wrap gap-2","children":[["$","span",null,{"className":"font-mono rounded-[2px] border border-[var(--hm-mint)]/30 bg-[var(--hm-mint)]/10 px-2.5 py-1 text-[11px] uppercase tracking-wider text-[var(--hm-mint)]","children":"Ethical hacking"}],[]]}],["$","h1",null,{"className":"font-display text-3xl font-bold leading-tight tracking-[-0.01em] text-[var(--hm-text-strong)] sm:text-[2.5rem]","children":"My Experience on Hacking the Dutch Government"}],["$","p",null,{"className":"mt-4 text-base leading-relaxed text-[var(--hm-muted)]","children":"Hello, fellow Bug Hunters! It’s me again Jefferson Gonzales, and in this article, I’ll tell you about how I got my dream Dutch Government SWAG, and without wasting your time let’s get started. On May "}],["$","div",null,{"className":"mt-5 flex flex-wrap items-center gap-x-3 gap-y-2 border-t border-[var(--hm-border)] pt-5 font-mono text-xs text-[var(--hm-muted)]","children":[["$","span",null,{"className":"flex items-center gap-2","children":[["$","span",null,{"aria-hidden":true,"className":"flex h-7 w-7 items-center justify-center rounded-full border border-[var(--hm-ring)] bg-[rgba(0,230,118,0.08)] text-[11px] font-bold text-[var(--hm-mint)]","children":"R"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"rocky"}]]}],["$","span",null,{"aria-hidden":true,"children":"·"}],["$","time",null,{"dateTime":"2023-02-27T10:06:01.000Z","children":"Feb 27, 2023"}],[["$","span",null,{"aria-hidden":true,"children":"·"}],["$","span",null,{"children":[4," min read"]}]]]}]]}],["$","$L1f",null,{"items":[]}],["$","div",null,{"className":"blog-prose text-base leading-relaxed text-[var(--hm-text)]","children":["$","div",null,{"dangerouslySetInnerHTML":{"__html":"$20"}}]}],false,"$L21","$L22"]}],"$L23"]}]}]] c:null 11:[["$","title","0",{"children":"My Experience on Hacking the Dutch Government | Codelivly"}],["$","meta","1",{"name":"description","content":"Hello, fellow Bug Hunters! It’s me again Jefferson Gonzales, and in this article, I’ll tell you about how I got my dream Dutch Government SWAG, and without…"}],["$","meta","2",{"name":"author","content":"Codelivly Team"}],["$","meta","3",{"name":"creator","content":"Codelivly"}],["$","meta","4",{"name":"publisher","content":"Codelivly"}],["$","meta","5",{"name":"robots","content":"index, follow"}],["$","link","6",{"rel":"canonical","href":"https://codelivly.com/my-experience-on-hacking-the-dutch-government"}],["$","link","7",{"rel":"alternate","hrefLang":"en-US","href":"https://codelivly.com/my-experience-on-hacking-the-dutch-government"}],["$","meta","8",{"property":"og:title","content":"My Experience on Hacking the Dutch Government | Codelivly"}],["$","meta","9",{"property":"og:description","content":"Hello, fellow Bug Hunters! It’s me again Jefferson Gonzales, and in this article, I’ll tell you about how I got my dream Dutch Government SWAG, and without…"}],["$","meta","10",{"property":"og:url","content":"https://codelivly.com/my-experience-on-hacking-the-dutch-government"}],["$","meta","11",{"property":"og:site_name","content":"Codelivly"}],["$","meta","12",{"property":"og:locale","content":"en_US"}],["$","meta","13",{"property":"og:image","content":"https://codelivly.com/wp-content/uploads/2023/02/login-1203603_1280.jpg"}],["$","meta","14",{"property":"og:image:width","content":"1200"}],["$","meta","15",{"property":"og:image:height","content":"630"}],["$","meta","16",{"property":"og:type","content":"article"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:creator","content":"@codelivly"}],["$","meta","19",{"name":"twitter:title","content":"My Experience on Hacking the Dutch Government | Codelivly"}],["$","meta","20",{"name":"twitter:description","content":"Hello, fellow Bug Hunters! It’s me again Jefferson Gonzales, and in this article, I’ll tell you about how I got my dream Dutch Government SWAG, and without…"}],["$","meta","21",{"name":"twitter:image","content":"https://codelivly.com/wp-content/uploads/2023/02/login-1203603_1280.jpg"}],["$","link","22",{"rel":"shortcut icon","href":"/favicon.svg"}],["$","link","23",{"rel":"icon","href":"/favicon.svg"}],["$","link","24",{"rel":"apple-touch-icon","href":"/favicon.svg"}],["$","$L24","25",{}]]