I hacked India's GST portal–11.8M taxpayers exposed; enabling stock manipulation

Comments (1)

LuD1161 · 1d ago

I found an Insecure Direct Object Reference(IDOR0 security issue that led to leaking GST challans (receipts) of all the 11.8M registered taxpayers. Here's the full story alongwith a video PoC.

Note: No personal data was ever shared or harvested. This was responsibly disclosed to the authorities through proper channels and only after the disclosure timeline (120 days) was it published in the online media.

Does anyone think the current AI approach will hit a dead end?

Ask HN: How much can we trust open-source projects or our hardware?

Ask HN: Can an amateur make contributions to pure math or theoretical physics?

Ask HN: Is Reddit going the way of Stack Overflow?

Raku.org Chooses Htmx

Ask HN: How to avoid passive use of AI?

Ask HN: Looking for headless CMS recommendation

Ask HN: Who wants to be hired? (September 2025)

Ask HN: Are api.nasa.gov, data.nasa.gov down or shutdown?

Ask HN: Who is hiring? (September 2025)

Why the Technological Singularity May Be a "Big Nothing"

Ask HN: Significant reduction in AI related submissions?

Automated Workday check in/check out and Microsoft Teams messages monitoring

Ask HN: What do you think of the new Digg?

If AI agents take the jobs, who buys the stuff?

Ask HN: Moving from Dev to PM

Ask HN: Why does Google word privacy settings like you agree even when off?

New Member Alert

Ask HN: Is your company still hiring junior engineers?

Ask HN: LLM struggles to center div too?

Ask HN: Useful AI applications in regular businesses?

Ask HN: Why do LLMs struggle with word count?

A16Z scouting ambitious Swiss founders for $1M accelerator

Ask HN: How long did it take you to learn Git?

ASIC: Proof-of-Concept Binary Optimizer Reduces Size, More to Come

Tell HN: My advice after I applied to 450 positions before getting hired

Ask HN: When was the last time you visited Stack Overflow?

Ask HN: VSCode AI Autocomplete Woes

Ask HN: How do you fight YouTube addiction and procrastination? I'm struggling

File protection: anonymous, open source and fast

Ask HN: Is anyone here deliberately low‑tech? If so, why and how?

I hacked India's GST portal–11.8M taxpayers exposed; enabling stock manipulation

Comments (1)