How Pakistan google and other sites got hacked?

How Pakistan google and other sites got hacked ? Recently, The news about the Pakistani Google hack spread like a wildfire in the Internet.  At the time, Top Level Pakistan Domains displayed the defacement page including Yahoo, MSN, HSBC, EBay,Paypal and more sites.

Today, khanisgr8, a hacker from Pakistan hacker collective called “TeamBlackHats” sent an email regarding the security breach.  He explains how those websites got hacked by Turkish Hacker group “EBoz”.

The day before yesterday we mentioned those hacked sites’ dns records points to different free hosting site. Also we report that the site might be hacked using PKNIC vulnerability.

The hackers have claimed to have discovered a Boolean-based blind SQL injection, persistent cross site scripting, sensitive directory directory disclosure vulnerabilities in the official website of PKNIC.

PKNIC is responsible for the administration of the .PK domain name space, including the operation of the DNS for the Root-Servers for .PK domains,
and registration and maintenance of all .PK domain names. PKNIC is operated as a self-supporting organization.

They provide us the vulnerable link with POC to exploit it. Also they sent some data compromised using the vulnerability which contains database details, username and hashed password.

Xss vulnerability

He also provide the screenshot of the Cross site scripting vulnerability. When i tried to verify the XSS vulnerability, i just searched in google for the url and visit a PKNIC link.  After visiting the link, i just saw a text “<script>alert(“HACKED BY COde InjectOr”)</script>”. May be Code Injector team attempts to exploit the vulnerability.

“Apparently Google Pakistan has been defaced by a Turkish Hacker group ‘Eboz’ . It’s still quite hard to believe that Google server has been hacked. They really need to put a lot of focus on their defenses because if one website got hacked that means every other websites can be hacked. ” they said.

We have sent an email to PKNIC regarding the vulnerability and waiting for their response. We are not sure whether the vulnerability is fixed or not So we are not providing the vulnerable link here.