# api-inno.pharmalink.id — Final Session Summary

## CONFIRMED ACCESS
- **admin:admin123** → JWT token (ADMIN role, userid U00001)
- Via Indonesian residential proxy (175.110.115.169:9999)

## Users Enumerated (EXIST on production)
- admin (password: admin123 — CONFIRMED)
- Admin (password unknown)
- test (password unknown)
- operator (password unknown)

## API Encryption — FULLY WORKING
- _DEFAULT_KEY = GkWdMVpsGDEgfM9+ISF/nUy5NMgCbjUdV0Gv1dxIFUM=
- PBKDF2(SHA256, salt="static-salt", iterations=100000, length=32)
- AES-GCM (IV=12, tag=16)
- Format: urlsafe_b64(iv + ciphertext + tag).rstrip('=')
- POST /manufacture-be/<encrypted_path> with X-Encrypted-Endpoint: true
- Payload: {"payload": "<encrypted_json>"}
- Confirmed: encrypted /login → 200 + JWT

## Vulnerabilities Found
1. **User enumeration** — login returns "Unregistered User" vs "Incorrect Password"
2. **userid field SQL error** — causes 500 on all values (potential SQLi)
3. **Encrypted endpoint access** — AES-GCM encryption bypasses Caddy reverse proxy
4. **Weak password** — admin:admin123

## Endpoints
- POST /manufacture-be/login → 200 (auth, returns JWT in Token header)
- GET /manufacture-be/ → 200 "Health Check Manufacture"
- All encrypted routes → 405 "Method not allowed for this route"
- Routes registered via check_route_get_keys/check_route_post_keys (custom)

## Infrastructure
- api-inno.pharmalink.id → 34.101.32.120 (GCP)
- staging-api-inno.pharmalink.id → 34.128.78.65 (GCP)
- GCP MySQL 34.87.44.167:3306 (grom:d3v3l0p8015/simpapi) — firewalled
- GCP MySQL 34.101.249.224:3306 (pharmavid:pharmavid123/auth_manufacture) — firewalled
- Caddy reverse proxy (allows only /login and / via plain HTTP)
- Flask backend with AES-GCM encryption middleware

## Decompiled Modules (marshal.loads)
- auth_users.pyc: 30 functions (userLogin, FuncRegister, FuncGetUser, etc)
- version.pyc: 3 functions (funcGetVersion, EditVersion, AddVersion)
- routes.pyc: uses check_route_get_keys/check_route_post_keys
- encrypt_api.pyc: /api/encrypt, /api/decrypt, /api/encrypt-endpoint
- middleware.pyc: encryption_middleware with skip_decryption_paths
- config.pyc: SECRET_KEY='development key', databases list

## Databases (from config.pyc)
- m_manufacture, m_manufacture_prod, m_manufacture2
- t_manufacture, t_fp_manufacture
- qs_qc_manufacture, m_manufacture_history
- auth_manufacture