Prateek Varshney

Being antifragile ✌️

[Gitanjali J Angmo @GitanjaliAngmo]

I am not BJP. Nor Congress. Neither Sanghi nor Communist. Neither Left nor Right. Neither socialist nor capitalist. Neither liberal nor conservative. Neither Dalit nor Brahmin. Neither Jain, Buddhist nor Hindu. Neither Punjabi, Odia nor Ladakhi.

I am all of these, and more. Beyond all “isms”. I take the best from everything and leave the rest.

We diminish ourselves the moment we squeeze our infinite selves into man made buckets. Our deepest identity is not political, social, religious or ideological. It is consciousness itself.

���िदानन्दरूपः शिवोऽहम् शिवोऽहम्।
Chidānandarūpaḥ Śivo'ham Śivo'ham.

[Prateek Varshney @pratvy]

@ihailmyindia NTA does control who gets their hands on the question paper , isn't it? So you believe NTA is just morally responsible here ? Lack of stringent action against the perpetrators makes this issue worrisome, otherwise it's gonna keep on happening

[Prateek Varshney @pratvy]

@iamsum80 So you are saying if he had painted pm's face, he still be arrested? Lakhs of posters of politicians all across cities ...but this act of painting at public place without permission is not cause of sonam's painting...waah

[Prateek Varshney @pratvy]

@HardCricketpix Why is he looking like technical guruji

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[Prateek Varshney @pratvy]

@KHURAPATT @khurpenchh Sambhal lok sabha constituency , Uttar Pradesh

[Prateek Varshney @pratvy]

@TheKhelIndia 4 world cups from Indian women this year 🫡🇮🇳( chess , cricket, Kabaddi) what a dominance 💪

[Prateek Varshney @pratvy]

@Dravidict Field umpire is Bucknor ?

[MyGovIndia @mygovindia]

“Sare Jahan Se Achha, Hindustan Hamara”

VC: @ArvinBal27

#IndependenceDay
#HarGharTiranga2025
#IndependenceDay2025

[Prateek Varshney @pratvy]

@elitepredatorss Chacha sam ko raji kijiye 😁🙏

[Prateek Varshney @pratvy]

@GemsOfCricket Why so many Dexter clips as meme all of a sudden

[Prateek Varshney @pratvy]

@70yearoldsoul Just go to dariyaganj 😁😁

[Prateek Varshney @pratvy]

@theskindoctor13 This going good era was prime socialism , capitalism which came after lpg reform of 1991 introduced competition from global stage. Global brand came to know indian people inclination towards cheap and tikau items , fooled them by showbaazi more than quality prod.

[Prateek Varshney @pratvy]

@Rainmaker1973 Govt socialist schemes

[Prateek Varshney @pratvy]

@Osint613 Instead of exporting terrorism throughout the world , begging for funds , suffering losses then begging some more, paxtanis should really consider doing comedy, they are really good at it. Every single one of their pressers are so comical. It might even help them economically.

[Prateek Varshney @pratvy]

@Rainmaker1973 what do you mean ?

[Prateek Varshney @pratvy]

@mufaddal_vohra

[Prateek Varshney @pratvy]

@kamleshksingh

[Prateek Varshney @pratvy]

@AMAZlNGNATURE Justifying his name 🤩

[Prateek Varshney @pratvy]

@gemsofbabus_ Lee Kuan yew have already explained the process for such litterbugs tbh