LeakIX - Host isb.ac.th

Domain isb.ac.th

Switzerland

GOOGLE-CLOUD-PLATFORM

Software information

ESF ESF

tcp/443 tcp/80

Microsoft-IIS 10.0

tcp/80

cloudflare

tcp/443 tcp/80 tcp/8443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 18.141.40.12
Domain: api-campuscard.isb.ac.th
Port: 80
URL: http://api-campuscard.isb.ac.th

First seen 2025-11-03 02:18
Last seen 2026-02-10 00:41
Open for 98 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035497e949ad484818be00fa84a5956373dd1a6b426c0

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/account/get-settingmaster-value/{settingParameter}
GET /api/category
GET /api/category/get-category-by-vendor/{vendorId}
GET /api/customerprofile/get-customerprofile-forpossearch
GET /api/publicrequest/Test
GET /api/sales/get-sales-data/{invoiceNo}
GET /api/terminal
GET /api/terminal/{terminalid}
GET /api/userpaymentoptions/get-userpaymentoptions/{posprofileId}
GET /api/vendor
GET /api/vendor/{vendorid}
POST /api/account/check-account
POST /api/account/check-card-balance
POST /api/account/check-spend-limit
POST /api/account/get-allergens
POST /api/account/get-banneditems
POST /api/account/get-restricted-days
POST /api/changepassword
POST /api/customerprofile/get-profilephoto-photosync
POST /api/logout
POST /api/order/latest-order
POST /api/order/order-detail-by-orderid
POST /api/order/order-report
POST /api/order/update-orderstatus
POST /api/poslayer/get-poslayeritem
POST /api/poslayer/get-poslayermaster
POST /api/product
POST /api/product/get-item-details
POST /api/sales/SalesInsert
POST /api/sales/cancelsale
POST /api/sales/get-running-invoice-number
POST /api/sales/get-sale-details
POST /api/sales/get-sale-summary
POST /api/sales/get-sale-summary-byterminal
POST /api/sales/get-sales-byprofileid
POST /api/sales/issaleslimitexceed
POST /api/terminal/get-terminalprintermapping
POST /api/terminal/update-terminalstatus

Found on 2026-02-10 00:41

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 18.141.40.12
Domain: api-campuscard.isb.ac.th
Port: 443
URL: https://api-campuscard.isb.ac.th

First seen 2025-11-03 02:18
Last seen 2026-02-01 02:30
Open for 90 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035497e949ad484818be00fa84a5956373dd1a6b426c0

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/account/get-settingmaster-value/{settingParameter}
GET /api/category
GET /api/category/get-category-by-vendor/{vendorId}
GET /api/customerprofile/get-customerprofile-forpossearch
GET /api/publicrequest/Test
GET /api/sales/get-sales-data/{invoiceNo}
GET /api/terminal
GET /api/terminal/{terminalid}
GET /api/userpaymentoptions/get-userpaymentoptions/{posprofileId}
GET /api/vendor
GET /api/vendor/{vendorid}
POST /api/account/check-account
POST /api/account/check-card-balance
POST /api/account/check-spend-limit
POST /api/account/get-allergens
POST /api/account/get-banneditems
POST /api/account/get-restricted-days
POST /api/changepassword
POST /api/customerprofile/get-profilephoto-photosync
POST /api/logout
POST /api/order/latest-order
POST /api/order/order-detail-by-orderid
POST /api/order/order-report
POST /api/order/update-orderstatus
POST /api/poslayer/get-poslayeritem
POST /api/poslayer/get-poslayermaster
POST /api/product
POST /api/product/get-item-details
POST /api/sales/SalesInsert
POST /api/sales/cancelsale
POST /api/sales/get-running-invoice-number
POST /api/sales/get-sale-details
POST /api/sales/get-sale-summary
POST /api/sales/get-sale-summary-byterminal
POST /api/sales/get-sales-byprofileid
POST /api/sales/issaleslimitexceed
POST /api/terminal/get-terminalprintermapping
POST /api/terminal/update-terminalstatus

Found on 2026-02-01 02:30

Create report

Open service 2a00:1450:400a:1009::79:443 · cas.isb.ac.th

2026-01-26 12:15

HTTP/1.1 302 Found
Content-Type: application/binary
X-Frame-Options: DENY
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Mon, 26 Jan 2026 12:15:01 GMT
Location: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://sites.google.com/isb.ac.th/hscas&followup=https://sites.google.com/isb.ac.th/hscas
Cross-Origin-Opener-Policy: unsafe-none
Cross-Origin-Resource-Policy: same-site
Content-Security-Policy: base-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-HvsLwiBHoOu2B8qYqZsjdg' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://google-admin.corp.google.com/
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Connection: close

Found 2026-01-26 by HttpPlugin

Domain isb.ac.th

Switzerland

Software information

Swagger API description is publicly available

Swagger API description is publicly available

cas.isb.ac.th

uni.isb.ac.th

isbcentral.isb.ac.th

isb.ac.th

Domain summary

IP summary