I Found Vulnerabilities in a Government Company When I Was Just a Secretary

A little about me.

Before the Beginning

I was hacking before I had a job title.

At 17, I was on a plane with WiFi that required payment. I didn't pay. Instead, I spoofed my MAC address, grabbed a session from someone who did, and i want to see if i can get online, And it did. I was amazed when that worked!

( Gave it back of course )

I never went to university for cybersecurity. I never took a formal course. I learned from YouTube videos, online forums, TryHackMe, HackTheBox, late nights, and a lot of "what happens if I do this?" I studied and practiced practiced while everyone slept.

( It was COVID so i had a lot of free time and nothing to do )

By the time I got my first job, I wasn't trained but I wasn't a beginner either.

The job just happened to be as a secretary.

The Beginning

In 2019, I started working as an administrative assistant at a government telecommunications regulator authority. My official job was paperwork, scheduling, and making sure things ran smoothly. I had a secretary diploma.

But I had self-taught experience and a habit of looking at systems the way an attacker would.

One day, sitting at my desk with nothing urgent to do, I was looking at the Ethernet cable then i opened my laptop, plugged in an the Ethernet cable, and waited.

I was online. No login. No authentication. Nothing!!

That was the first vulnerability.

The Network That Welcomed Everyone

The company had no Network Access Control. For those unfamiliar, NAC is what stops random devices from joining a corporate network. Most organizations require authentication a certificate, credentials, something to prove who you are.

The network said: "Come on in."

Worse, after connecting, I checked my WiFi settings. The corporate WiFi password was right there, pushed to my personal device. A network that should have been segmented and protected was essentially open to anyone with an Ethernet cable or the curiosity to look.

The Workstations

I started paying attention to the computers around me.

Their PC allows any USB connects to it. A bootable USB was used and it showed me the employees who were using this PC and access their accounts with NO PASSWORD!! So i could sit down at any workstation and access to that employee desktop/downloads etc.

The BIOS wasn't password protected either. Which allowed me to boot from a USB drive, bypass Windows entirely, and access the hard drive directly. No forensic tools needed. Just a $10 USB stick with a Linux distribution.

The Printer

Every office has a printer. This one had a password.

It was "123456789"

I'm not making this up.

The Policies That Didn't Exist

I noticed visitors walking around unescorted. Contractors from tech support accessing systems without supervision. Some Passwords that hadn't been changed in over a year or more.

These aren't technical vulnerabilities they're policy failures. But policy failures become security failures fast. An attacker in a vest or something carrying a clipboard can walk into most buildings unchallenged.

The Website

I turned my attention to their website. I wasn't expecting much maybe some outdated software, a missing header or two.

I found a stack trace.

For non technical readers: a stack trace is an error message that developers use to debug problems. It should never be visible to the public because it reveals internal details server software, file paths, sometimes database information. It's a roadmap for attackers.

Then I found /_vti_bin/. when i viewed the page source

This is a folder left over from Microsoft FrontPage, a website editor that was discontinued in 2003. Twenty years later, this government company was still exposing its FrontPage server extensions to the internet. I could see the directory listing, access configuration files, and identify the exact version of software running.

But the best part was /static.

"There's Nothing Sensitive in /static"

I mentioned to an IT employee that their /static folder was publicly accessible. He shrugged.

"It's just files we use. Nothing sensitive."

I looked anyway.

Inside, I found an SQL dump. For those unfamiliar, this is a backup file containing database structure and sometimes data. This one included:

• Database name
• Database version
• Table structures
• A username and password. In plaintext.

I showed him.

He stopped shrugging.

The COVID App

In 2020, like many countries, this nation launched a COVID-19 tracing and vaccination app. Citizens were required to use it. It contained their health status, vaccination records, and personal information.

I looked at it.

I found that by manipulating API requests, I was able to access personal data belonging to other citizens. Not just a few potentially the entire country's health records. Names. IDs. Vaccination status. Phone numbers. Addresses.

Worse, I also could modify vaccination status. The app displayed a colored code green for vaccinated, red for unvaccinated. Security guards at malls and restaurants would check this screen. They didn't scan anything. They just looked.

I could have made anyone appear vaccinated. Or unvaccinated. The nation's health verification system was built on trust in a colored screen.

It also had admin hard coded credentials.

I reported it.

The Chatbot

The company had a public chatbot on their website an AI assistant to help citizens with inquiries. I inspected the JavaScript.

The findings came fast:

• Hardcoded customer ID in client-side code
• Insecure token handling via sessionStorage
• Client-side role control — I could change my role from "user" to "admin" in the request
• WebSocket session hijacking — the connection URL itself was the authentication
• Dialog enumeration — I could probe for hidden admin dialogs
• No script integrity checks — external scripts loaded without verification
• Prompt injection — I could manipulate the AI's responses
• Jailbreak — I could make the AI ignore its guidelines

Eight vulnerabilities in one chatbot.

The Response

You might expect a government company one that regulates telecommunications and cybersecurity to take this seriously.

You'd be wrong.

When I reported the COVID app vulnerability, the response wasn't "thank you" or "we'll fix it." It was:

"Nice skills. Prove that you can change the vaccination status."

They challenged me. A secretary. To prove that their national health app was vulnerable.

I didn't exploit it. I didn't access real citizen data. I documented what I found, showed how it could be done, and waited.

They eventually fixed some of it. Quietly the shutdown the application. No acknowledgment. No thank you.

The Lesson

I left that job in 2024 after i kept asking to change my job title. I'm now a penetration tester at a bank the thing I taught myself to do while filing papers.

Here's what I learned:

1. Credentials don't equal competence. I had no degree, no certifications, no formal training. I found vulnerabilities in a government company by being curious and methodical. Meanwhile, their credentialed IT staff told me there was nothing sensitive in /static

2. Organizations don't want to hear bad news. When you find vulnerabilities, you're not a hero. You're a problem or a threat. You're the person telling them their house isn't safe. Some people thank you. Most people ask why you were looking at their locks.

3. The basics matter more than the advanced stuff. I didn't use zero-days. I didn't write custom exploits. I plugged in a cable. I read a JavaScript files. The most critical findings came from the simplest techniques.

4. Government systems are held together by hope. This isn't unique to one company. I've since found vulnerabilities in healthcare systems, banks, telecoms, military infrastructure, and critical systems like water treatment. The pattern is always the same: good intentions, limited budgets, and decades of technical debt.

Why I'm Writing This

Not to shame anyone. I haven't named the company, the country, or any individuals.

I'm writing this because somewhere, right now, there's another secretary. Another help desk technician. Another curious person with no credentials but a lot of questions.

You don't need permission to learn. You don't need a degree to see what's broken. You don't need a title to make things better.

You just need to ask: "What if I try something stupid?"

Final Thought

I still have my secretary diploma. It's somewhere in a drawer i think.

I also have 140+ confirmed vulnerabilities across 23 sectors. Banks. Hospitals. Governments. Telecoms. Defense. Critical infrastructure. Global platforms with billions of users.

No one taught me this.

I just asked questions no one else was asking.

And I never stopped.

If you're curious about security but don't know where to start , start where you are. Look at what's in front of you. Ask questions. Document everything. Report responsibly.

The best hackers aren't the ones with the most credentials. They're the ones who never stopped being curious.

Thank you for reading

See you in the next one.