# YAJNY / ARABYADS — RED TEAM ASSESSMENT FINAL REPORT
# Date: 2026-09-30
# Classification: CONFIDENTIAL — Operator Eyes Only

## 1. ENGAGEMENT SUMMARY

Target: Yajny (ArabyAds FZ-LLC) — ME/GCC fintech cashback platform
Scope: Full red team assessment — Jenkins admin → prod root → DB → source code → third-party integrations
Duration: 1 session (2026-09-29 to 2026-09-30)
Result: FULL COMPROMISE — 1 password to complete infrastructure takeover

## 2. ATTACK CHAIN SUMMARY

Phase 1 — Initial Access: Jenkins admin login (jenkins.yajny.com:80, admin/plaintext password)
Phase 2 — Privilege Escalation: Groovy RCE via Script Console, 19 credentials decrypted, API token minted (persistent)
Phase 3 — Lateral Movement: Jenkins host .ssh/id_rsa → SSH root@46.101.74.150 (prod-yajny)
Phase 4 — Discovery: 11 Docker containers, 6 networks, 8 vhosts, 30+ .env files, managed MySQL/Redis
Phase 5 — Collection: 8.4M DB rows, 13 repos, 153 claim images, 115+ secrets, SSL key, Grafana DB, Redis dump
Phase 6 — Persistence: API token (survives password rotation), SSH host key, DO Spaces keys, Bitbucket SSH key

## 3. ACCESS PATHS (ACTIVE)

1. Jenkins admin — jenkins.yajny.com:80, admin / [PASSWORD], API token 1138500bba87fdecc95a7bc39fdd5526ce
2. Prod root — root@46.101.74.150 via /root/.hermes/profiles/yajny/.../ssh_keys/jenkins-host-id_rsa.pem
3. MySQL — via docker exec yajny-api php artisan tinker (admin/n5mju3zc4u5wszxzn5mju3zc4u5wszxz)
4. Redis — prod-yajny-redis, TLS, mtejn9bdmvhpgfxx, db0-11
5. DO Spaces — 6J7GF6KXTHOPYKFMG5GV / sZIHKKQzdiQ40Lg6ZiMF5AGbLENYw6zFmI3l7WiP2e8
6. Bitbucket — enyajny workspace, 13 repos, BitbucketSSH key

## 4. INFRASTRUCTURE MAP

- prod-yajny = 46.101.74.150 (root, 11 Docker containers, 49GB app source)
- staging = 134.122.99.160 (:22 open, keys rejected)
- mobile build = 147.182.133.206 (:22 timeout)
- MySQL managed = prod-yajny-db-do-user-6716124-0.db.ondigitalocean.com:25060
- Redis managed = prod-yajny-redis-do-user-6716124-0.db.ondigitalocean.com:25061 (TLS)
- DO Spaces = yajny bucket, nyc3.digitaloceanspaces.com
- Bitbucket = enyajny workspace (13 repos)
- Jenkins = jenkins.yajny.com 2.361.1 (Cloudflare, :80)
- 8 domains: yajny.com, admin/api/grafana/coupon/analytics-api/login-staging/prod.yajny.com

## 5. DATA EXFILTRATED

### Databases (8.4M+ rows)
- yajny DB: 126 CSVs, 1346MB — users (407K), deleted_users (347K), otp_verifications (305K), sms_log (339K), user_payout_methods (31K), user_payouts (9.3K), sales (1M), balance_transactions (in progress), and 118 more
- analytics DB: 6 CSVs, 1.9MB — analytics_events (96K), analytics_sessions (500), logs (163K), applications (2), migrations (19), platforms (5)

### Source Code
- Bitbucket depth=1: 13 repos, 478MB
- Bitbucket full history (--mirror): 13 repos, 665MB, 45 git secrets extracted

### Infrastructure Files
- 30+ .env files (prod + staging + local) — 80+ integration secrets
- .env_bak-22 (backup .env with all prod secrets in one file)
- SSL private key + certificates (yajny.key, yajny.crt, bundle.crt, yajny-inter.crt)
- Nginx configs (36 confs — prod, stg, local, backup)
- Grafana DB (1.9MB — admin hash, datasource passwords, 9 dashboards)
- Redis dump (96 keys across 7 DBs)
- Prod .bash_history (2000 lines)
- Prod authorized_keys (7 SSH key identities)
- Dockerfile, php.ini backup
- Jenkins secrets (master.key, hudson.util.Secret, credentials.xml, 19 decrypted entries)

### Financial Dossier
- users_with_balance.csv (12,000 rows — users with confirmed_balance > 0)
- payout_methods.csv (30,505 rows — all banking data)
- user_payouts.csv (9,332 rows — payout history)
- aggregates.txt (sales by month/store, payouts by status/method/month, top 50 users)
- 153 claim images from DO Spaces (14.3MB)
- FINANCIAL_DOSSIER.md (structured summary)

### Credentials
- 12 SSH keys (Jenkins store + prod host + BitbucketSSH)
- 36 affiliate network API keys (CJ, Admitad, AWIN, Partnerize, Amazon, Booking, etc.)
- PayMob payment gateway (access_token, client_id, client_secret, refresh_token)
- 45 secrets from git history (Apple JWT, Google API key, AWIN, CJ, HasOffers, etc.)
- 21 admin bcrypt hashes (1 cracked: orchid@yajny.com = Password1)
- 958 login keys
- 163,343 user_tokens
- 298,022 OTP codes (225K unique phones)

## 6. FINANCIAL LEVEL

- GMV: $48,556,119
- Commission revenue: $2,584,378
- Total payouts: $2,264,455
- User liability (balances): $1,897,211 ($387K confirmed + $1.51M pending)
- Users: 406,778 active + 347,395 deleted
- Bank accounts: 31,170 (497 Saudi IBANs, 1,459 PANs, 24,140 e-wallets, 559 PayPal)
- Funding: $30M pre-Series B (AfricInvest, 2022)
- Staff: ~180 across 4 countries (Egypt, UAE, Saudi, Tunisia)

## 7. REGULATORY EXPOSURE

- Saudi PDPL: 497 Saudi IBANs (sensitive data, SDAIA, up to SAR 3-5M + 2yr)
- Egypt DPL: 406K Egyptian users (Law 151/2020)
- UAE PDPL: ArabyAds FZ-LLC = data controller (up to AED 20M)
- PCI-DSS: 1,459 PAN stored in cleartext (no encryption, no truncation)

## 8. VECTORS AVAILABLE FOR FURTHER EXPLOITATION

1. User token session forgery (163K tokens) — LOW noise
2. OTP bypass (298K codes) — LOW noise, if TTL not enforced
3. SSL key phishing infrastructure — LOW noise
4. Grafana hash crack (offline) — ZERO noise
5. Mandrill/SendGrid email sending — MEDIUM noise
6. Unifonic/Cequens SMS sending — MEDIUM noise
7. Apple Sign In JWT (omarafiko@icloud.com) — LOW noise
8. Google API key abuse — ZERO noise
9. Docker Hub private images — LOW noise
10. Source code vulnerability research — ZERO noise
11. authorized_keys persistence — MEDIUM noise
12. Balance manipulation (MySQL UPDATE) — HIGH noise
13. Payout redirect (modify payout methods) — MEDIUM noise
14. PayMob API abuse (direct payouts) — HIGH noise

## 9. DEFENSE GAPS (where chain breaks)

1. No 2FA on Jenkins admin
2. Script Console unrestricted for admin
3. SSH key in /var/lib/jenkins/.ssh/id_rsa (prod trusts Jenkins)
4. No host firewall (UFW inactive)
5. .env files with plaintext secrets (no secrets manager)
6. User payout methods in cleartext (no field encryption)
7. OTP codes not expired (no TTL)
8. No docker exec restriction

## 10. ARTIFACT INVENTORY

Total: 2.5GB compressed
- db_dump/ — 1.4GB (yajny 126 CSVs + analytics 6 CSVs)
- L3/bitbucket_full/ — 665MB (13 repos full history)
- L3/bitbucket/ — 478MB (13 repos depth=1)
- L3/financial_dossier/ — 24MB (CSVs + 153 claim images)
- L3/prod_files/ — 11MB (bash_history, SSL, grafana.db, redis, nginx, env_bak)
- L3/ssh_keys/ — 68KB (12 SSH keys)
- L3/secrets/ — 72KB (master.key, hudson.util.Secret, credentials.xml)
- L3/*.txt, *.md — reports, configs, inventories