Pakistan

============================================================ CAMPAIGN STATS ============================================================

Operation Statistics

On 01 March 2026, during active Pakistan-Afghanistan hostilities (Operation Ghazab Lil Haq), ODINT conducted a 3-hour passive reconnaissance sweep of Pakistani government and academic digital infrastructure. All data was extracted through Tor using entirely open-source methods — no exploits, no authentication bypass.

============================================================ CONTEXT ============================================================

The Wartime Context

Pakistan's digital infrastructure cracked in two on 01 March 2026. Core government — the President's Office, Parliament, the Nuclear Commission (PAEC), the State Bank, the Federal Board of Revenue, national railway, NADRA's public services — went completely silent. Whether through deliberate defensive shutdown or genuine infrastructure collapse under the weight of Operation Ghazab Lil Haq, 35+ major .gov.pk domains returned no response.

What remained standing tells its own story. The institutions Pakistan did not protect — its universities, a provincial government, an open data portal, two federal admin panels — were left fully exposed, with no additional WAF deployment, no IP restriction, and in some cases running web servers seven years out of date.

Pakistan prioritized protecting its nuclear and financial infrastructure. It forgot its universities, its poorest province, and its open data platform entirely.

============================================================ INFRASTRUCTURE STATUS ============================================================

Infrastructure Collapse: What Went Down

Of 57+ Pakistani domains scanned during active hostilities, 65% were completely unreachable, 17% were behind WAFs blocking Tor, and only 21% remained accessible and functional.

Completely Unreachable (>35 domains)

Behind WAF — Tor Blocked (10 domains)

Full wartime infrastructure status with all 57+ domains: Wartime Infrastructure Status

============================================================ LIVE TARGETS ============================================================

Live Targets: What Stayed Open

Twelve domains remained accessible and were subjected to deep enumeration. The institutions left exposed reveal a pattern of neglect that no wartime defensive posture corrected.

============================================================ WORDPRESS EXPOSURE ============================================================

WordPress REST API: Three Government Installations Fully Exposed

Three Pakistani organizations expose their complete WordPress REST API without authentication: Quaid-i-Azam University, the Government of Balochistan, and Balochistan's Science & IT Department. Combined extraction: 13.4 MB of structured government and academic data.

============================================================ PERSONNEL INTELLIGENCE ============================================================

Personnel Intelligence: 340+ Named Individuals

Across all targets, 340+ individuals were identified with varying degrees of personal contact information. All data was extracted from publicly accessible sources without authentication.

Balochistan Divisional Commissioners

Eight senior provincial administrators were identified by name and division from WordPress page content — including the commissioner for Makran Division (Dawood Khan Khilji), which borders Iran and hosts Gwadar Port, the centerpiece of CPEC.

QAU Staff Directories — Sample

The following is a partial sample of data extracted from publicly accessible QAU staff pages. Direct phone extensions, institutional and personal email addresses, and organizational positions were recovered for 65+ individuals.

============================================================ OPEN DATA CKAN ============================================================

Open Data Portal: 1,471 Government Datasets

Pakistan's Open Data Portal (opendata.com.pk) runs CKAN 2.8.3 on a server dating from October 2017. Despite declaring /api/ off-limits in robots.txt, the entire API is freely accessible without authentication.

============================================================ ADMIN PANELS ============================================================

Exposed Federal Admin Panels

Two federal government websites expose administrative login panels directly to the internet with no WAF, no IP restriction, and no CAPTCHA — during an active military conflict.

============================================================ SERVER DISCLOSURE ============================================================

Server Configuration Disclosure: LUMS phpinfo.php

Lahore University of Management Sciences exposes a phpinfo.php page (96 KB) revealing the complete server stack: hostname, kernel, OS version, PHP extensions, database config, and file system paths — a complete fingerprint for targeted exploitation.

============================================================ BALOCHISTAN DEEP ============================================================

Balochistan: Province in the Crosshairs

Balochistan is Pakistan's largest province by area (44% of Pakistan's territory), its strategic corridor for CPEC, and the host of Gwadar Port — China's Indian Ocean access point. During the Pakistan-Afghanistan war, it became a critical frontline zone. It was also the only remaining live provincial government.

The provincial WordPress API exposed divisional commissioner appointments across all 8 Balochistan divisions, complete budget documents from 2020 to 2026, legislation from 14+ departments, and the staffing list for Gwadar's surveillance infrastructure. The dual-TLD situation (.gov.pk and .gob.pk) creates additional impersonation risk.

============================================================ GOVERNMENT INFRASTRUCTURE MAP ============================================================

Government Digital Infrastructure

Pakistan's government digital infrastructure is centralized around a small number of critical systems. During wartime, all were either offline or locked down. The following represents the post-war targeting landscape.

NADRA — National Identity Under Wartime Lockdown

NADRA's Nishan API platform — which powers Verisys (demographic verification), Biosys (biometric fingerprint), Multi-biometric (fingerprint + facial), and Proof-of-Life services for 220+ million Pakistani citizens — went completely dark. All six public-facing NADRA endpoints returned errors ranging from 403 to 500.

NADRA's CNIC number format encodes province, district, tehsil, union council, family lineage, and gender in 13 digits. A compromised CNIC dataset does not just expose an ID number — it maps a person's entire administrative geography.

============================================================ BREACH HISTORY ============================================================

Historical Breach Timeline

Pakistan's current exposure sits on top of a documented history of serious incidents.

============================================================ DATA INVENTORY ============================================================

Data Inventory

============================================================ DETAILED ANNEXES ============================================================

Detailed Technical Annexes

Nine specialized reports cover each area of the operation in full technical depth.

============================================================ DISCLAIMER ============================================================