Hello Hackers! 👋
I hope you all are doing well, securing our digital world, and safeguarding the digital infrastructure of our country. 🛡️ As many of you know, India is undergoing a massive digital transformation, with the push towards a cashless economy and more digital services becoming available each day. With that comes the increased importance of cybersecurity.
According to various reports, India needs around 10 to 30 lakh ethical hackers and cybersecurity professionals to keep up with growing cyber threats, yet we currently produce only around 5 lakh specialists. This gap creates a crucial demand for cybersecurity experts, and in the near future, we may see the government release even more opportunities for ethical hackers and cybersecurity professionals.
In this rapidly evolving field, it’s our responsibility to contribute toward a secure digital India. I’m proud to say that I’ve had the chance to do just that by discovering vulnerabilities in government websites, reporting them, and receiving acknowledgements from authorities. 🚨
What is NCIIPC? 🤔
Before diving into the story, let’s talk about NCIIPC The National Critical Information Infrastructure Protection Centre. It is the Indian government agency responsible for protecting the country’s Critical Information Infrastructure (CII), which includes servers, databases, banks, power plants, and telecom networks.
If you ever find a bug on a government website (ending with .gov.in), you can report it to the NCIIPC Responsible Vulnerability Disclosure Program (RVDP) via their official website: https://nciipc.gov.in/RVDP.html Based on the severity of the bug, they patch it and acknowledge your contribution. This is where I reported my findings, contributing to securing Digital India. 🇮🇳
Now, let me share my story of discovering two critical vulnerabilities on Indian government websites and how the government acknowledged my efforts. 🚀
First Bug 🐞
Recently, I found a high and medium-severity vulnerability on one of the Indian government websites, let’s call it “target.gov.in” for security reasons. The website was using WordPress, and as many security professionals know, WordPress sites can be vulnerable if not configured properly. I began testing for WordPress-related bugs, and soon, I found a critical one.
Vulnerability #1: XML-RPC Attack 🚧
The website had XML-RPC enabled, which is a feature in WordPress used for functions like pingbacks and trackbacks. However, when misused, it can lead to large-scale DDoS attacks and brute force attacks on login credentials. Here’s how I discovered it:
Host: target.gov.in
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>
The response I received confirmed that XML-RPC was enabled. This made the site vulnerable to DDoS attacks, as XML-RPC can be automated to send requests from multiple hosts, overwhelming the server. It could also be used to brute force admin credentials and gain unauthorized access to the website. 😱
Example of Brute Force Attack Request:
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>{your_username}</value></param>
<param><value>{your_password}</value></param>
</params>
</methodCall>
How to Fix It 🛠️
I suggested that the XML-RPC file should either be disabled or removed if not in use. At the very least, it should be blocked from external access to prevent such attacks.
After reporting this, the issue was acknowledged, and I was glad to contribute to securing the country’s digital infrastructure! 🙌
Second Bug 🐞
The second vulnerability I found was even more critical. This time, it was on an education-related government website that was leaking Personally Identifiable Information (PII) and sensitive documents, including exam papers.
Vulnerability 2: Directory Listing Exposure 🔍
While using Google Dorking techniques
I discovered that one of the directories on the website was exposed to the public. Anyone could access the /wp-content/uploads/ folder and view or download the files stored there. This directory contained exam papers and documents with sensitive personal data.
Steps to Reproduce:
- Open a web browser.
- Navigate to the URL:
https://target.gov.in/wp-content/uploads/. - You will see the entire list of files and folders within the uploads directory, including sensitive documents.
Impact 💥
The directory listing vulnerability exposed critical information that unauthorized users could access. This type of vulnerability can lead to:
- Exposure of sensitive data (personal data, exam papers, etc.)
- Potential data breaches
- Information leakage for future attacks
- Compliance violations (such as violating data protection regulations like GDPR)
How to Fix It 🛠️
To fix this, I recommended disabling directory listing by adding the following line to the website’s
.htaccess file:
Additionally, I advised the site administrators to restrict access to sensitive directories and implement proper authentication to prevent unauthorized access.
Acknowledgement and Contribution 🏆
Both vulnerabilities were reported to the concerned authorities, and they took swift action to patch the issues. Although I didn’t receive a formal letter of recognition, my contribution was acknowledged, and that itself felt rewarding. Knowing that I had helped secure the digital landscape of my country is what drives me to keep going.
Final Thoughts 💭
Cybersecurity is an ever-growing field, especially with India’s push towards digital transformation. With numerous vulnerabilities still present, I encourage all ethical hackers to step up and contribute to keeping our country’s digital space safe and secure. 🚀
Remember, it’s not just about finding bugs it’s about making a meaningful impact on the security of the digital infrastructure we all depend on.
Thank you for reading, and I hope you learned something valuable from my experiences. Keep hacking, keep securing, and let’s work together to safeguard our digital future! 💻🔐
Keep Hacking, Keep Securing, Keep Safe.
Thank You!
MR.X FACTOR
Handles:
- Linktree: https://linktr.ee/mrxfact0r_99