# Proactivity : help prevent a major security breach
# seriousness : handle threat and protecting data
# bank vision :
qrBe#yB3egmV!bt
[e-mail]






Bypassing the Key Attestation API with Remote Devices github

https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-advance/1.0/validate/customer/eligible
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-advance/1.0/view/contract/loan
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-advance/1.0/loan/commit
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/validate/customer/eligible
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/loan/inquiry
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/view/contract/loan
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/loan/commit
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/loan/recommit
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/loan/pay-off/inquiry
https://uatsandbox.sathapana.com.kh:2284/new-mobile-banking/uat/salary-upl/1.0/loan/pay-off/commit


const extractAllValues = (value) => {
if (value == null) return '';

// Handle environment variables
if (typeof value === 'string' && value.startsWith('{{') && value.endsWith('}}')) {
return pm.environment.get(value.slice(2, -2)) || '';
}

// Recursively process objects (sorted keys)
if (typeof value === 'object' && !Array.isArray(value)) {
return Object.keys(value)
.sort() // Sort keys alphabetically
.map(key => extractAllValues(value[key]))
.join('');
}

// Recursively process arrays
if (Array.isArray(value)) {
return value.map(item => extractAllValues(item)).join('');
}

// Convert non-strings to strings
return typeof value === 'string' ? value : String(value);
};

const buildHashString = (payload) => {
return Object.keys(payload)
.sort() // Sort root keys A-Z
.filter(key => key !== 'hash') // Skip the hash field
.map(key => extractAllValues(payload[key]))
.join('');
};

// Main Execution
try {
const timestamp = Date.now();
pm.environment.set("timestamp", timestamp);

const requestBody = JSON.parse(pm.request.body[pm.request.body.mode]);
const secretKey = pm.environment.get("secret_key");

const payloadString = buildHashString(requestBody);
const hashValue = `${secretKey}${payloadString}${timestamp}`;

console.log("Hash computation string:", hashValue);

const hashedPayload = CryptoJS.enc.Hex.stringify(CryptoJS.SHA512(hashValue));
pm.environment.set("hash", hashedPayload);

} catch (error) {
console.error("Hash generation failed:", error);
throw error;
}



1539292
172.17.251.53

https://maps.app.goo.gl/xXGSbsrk82cCLUgYA

qxwVzVBeHL9fX01sAVFv1WxGIvhN+Q==




# h1 Proactivity : prevent data breach
# h1 seriousness : handle threat and protecting data

PENTEST/Pent@s#$402212

Room: C1
Booked number: 096 400 3497
Arrival time: 6:00 to 6:30 PM
Contact number: 095 22 381

Subject: Penetration Testing Completion – Sathapana Onboarding App 2025 Release 2
Dear Bong @Khov Puthsovann, @Touch Ra, and @Ky Seng Hak,
I would like to inform you that I have successfully completed the penetration testing for Sathapana Onboarding App 2025 Release 2.
Please find the detailed report attached for your review.