Abhay 🍥

तन्त्रांश अभियन्ता

[Deedy @deedydas]

A 19-year old broke into India's largest high school examination system of 2M+ students a year, the CBSE, and was able to view and CHANGE any students' marks.

He responsibly wrote to the team 3 months ago, and it took them 3 days to fix only one of the issues. Today, they took the entire website down.

This is a absolute embarrassment. The futures and lives of millions rests in the hands of the utterly incompetent. There is also no mass media reporting on the matter.

This topic is close to me because not only is this the education system I went through, but 12 years ago and silently for 5yrs since, I'd written about and reported a much less severe vulnerability allowing me to scrape these results too. More than a decade later, not much has changed.

This 19yo, Nisarga Adhikary, wrote a great piece outlining each vulnerability he reverse engineered:
- the master password leak
- the client-side 2fac / OTP validation workaround
- tokenless access to the entire internal app (dashboard, evaluator details, etc) setting dummy browser values
- changing any password without knowing the old one
- an IDOR vuln allowing you to act as any user and edit exam marks

For those interested in a beautiful study in security breaches, this is a must read (link below).

If there's any light at the end of the tunnel, it's that a 19yo who never went to college can do things 99% of top engineers couldn't figure out.

[Yukti Gupta @Yu13197]

https://t.co/7Z4i7tvKfK

[Abhay 🍥 @avyaalik]

@kshitijandquant Link please ! @kshitijandquant

[Abhay 🍥 @avyaalik]

@VinodSharma10x After all that water being sprayed around the Delhi monitoring site, how are you still showing an AQI of 359? It should be well below 200.

[Abhay 🍥 @avyaalik]

@MehulFanawala 2012 👋

[Abhay 🍥 @avyaalik]

@KHURAPATT when in doubt blame congress.

[Abhay 🍥 @avyaalik]

@RantStormmm @narendramodi But in the end, it is our soldiers who pay the price with their lives, a pain politicians will never truly know.

[Abhay 🍥 @avyaalik]

@NanoBaiter @raebarelipolice @Cyberdost

[Abhay 🍥 @avyaalik]

@theliverdoc @GoalNeel Will do it free for you.

[Abhay 🍥 @avyaalik]

@TheWriterWoman_ 💯

[Abhay 🍥 @avyaalik]

@TheWriterWoman_ ati sundar ❤️❤️

[Abhay 🍥 @avyaalik]

@MehulFanawala @TheWriterWoman_ Best Solution

[Abhay 🍥 @avyaalik]

@elonmusk @nsitharaman @narendramodi

[Abhay 🍥 @avyaalik]

@NalinisKitchen Lol great PR act.

[Abhay 🍥 @avyaalik]

@Damilo_lah @actress_trendz @TheMovieScenes The Day of the Jackal (10 episodes) airs weekly on Sky (UK) a week before Peacock (US). 8 episodes out now; finale on Dec 5 (Sky) / Dec 12 (Peacock).

Suspense, espionage, & Eddie Redmayne's brilliance! 🔥

[Abhay 🍥 @avyaalik]

@eileenonthelord 👍

[Abhay 🍥 @avyaalik]

@deepigoyal @TheBigGeek @zomato @bhash learn.

[Abhay 🍥 @avyaalik]

@TheWriterWoman_ 🎈

[Abhay 🍥 @avyaalik]

@aaliya_goyal @discord @discord_support Enemies? Seriously, who would even dare to be your enemy?