Red Team Assessment · Project 1

HITS Smart Campus Cyber Risk Dashboard

Himalaya Institute of Technology & Sciences (HITS) · Grey-box Red Team Assessment & Penetration Test · 12,000 students

Executive Question

“Could an attacker realistically compromise student records or university operations - and if so, how do we stop them?”

!
Yes.
3 attack chains · no insider needed
Answer

Yes. Three realistic attack chains reach student records and core university operations without insider help - the fastest starts from an outdated, internet-facing student portal and ends at the student database. 36 critical findings need immediate action, but every chain is broken by patching the exposed portal, enforcing MFA on admin access, and closing the open mobile API.

175
Assets in scope
110
Vulnerabilities
36
Critical findings
need immediate action
110
OSINT findings
3
Attack chains

Findings by Severity

110
findings
High5348%
Critical3633%
Medium2119%

Risk Level — Likelihood × Impact

Critical
53
High
49
Medium
8

Assets by Network Zone

175
assets
CORE12370%
DMZ3822%
CLOUD116%
DR32%

OSINT by Sensitivity

Medium
48
High
35
Low
27

Findings by Category

RCE
15
Auth
12
Misconfig
11
Network
8
Injection
7
Crypto
7
DB
6
API/AuthZ
5
XSS
5
Info Leak
5
Web Server
4
Secrets
4
API/Auth
3
IoT
3
Cloud Misconfig
3
OS EOL
3
SSRF
2
VPN
1
Config
1
API/Brute
1
Firewall
1
Business Logic
1
Data Exposure
1
CSRF
1

Top 10 Risks by Score

Likelihood × Impact
IDFindingHostZoneCVSSSeverityRisk
V-001Apache 2.4.41 path traversalportal-web01DMZ9.8Critical25
V-003API missing auth on /v1/studentsapi-gwDMZ9.1Critical25
V-011FortiOS SSL-VPN path traversalvpn-gwDMZ9.8Critical25
V-019Apache mod_cgi RCElibrary-webDMZ9.8Critical25
V-020Exam portal SQLi in id paramexam-portalDMZ9.1Critical25
V-033PAN-OS GlobalProtect RCEfirewall-perimeterDMZ10Critical25
V-037S3 bucket public write accesss3-bucket-backupsCLOUD9.1Critical25
V-038MongoDB no auth internet exposedcloud-mongodbCLOUD9.8Critical25
V-052Scholarship portal SQLischolarship-portalDMZ9.1Critical25
V-067Placement file upload RCEplacement-webDMZ9.8Critical25

Attack Chains to Crown Jewels

AC-1

External Web/API Path to Student Records

No insider needed

An external attacker reaches the full 12,000-record student database with no insider help, using only OSINT-leaked information and unauthenticated web/API flaws. This chain is corroborated by the dummy access logs.

◆ Crown jewelStudent records (PII: name, phone, masked Aadhaar, grades, hostel)
1OSINT / Recon

Discover exposed config with DB string and leaked CampusSoft API key

[O-001, O-002, O-004]
↓
2Initial Access

Hit mobile API /v1/students with no auth -> full 12k-record dump

[V-003]
↓
3Privilege / Data

Use IDOR on /v1/students/{id} to enumerate any student sequentially

[V-004, V-050]
↓
4Alternate Access

SQL injection in student portal login bypasses auth to student DB

[V-005]
↓
5Exfiltration

Export students.csv via portal; observed in access logs

[V-005]
AC-2

Network Perimeter to Domain Admin

No insider needed

An attacker breaches the perimeter via the FortiOS VPN flaw, pivots into the CORE zone, and escalates to Domain Admin via Zerologon - gaining control of ERP, payroll, and all internal systems.

◆ Crown jewelActive Directory / ERP / Payroll (full university operations)
1OSINT / Recon

Shodan reveals FortiGate VPN banner v6.4.3 and exposed RDP jump-host

[O-005, O-024]
↓
2Initial Access

Exploit FortiOS SSL-VPN path traversal to harvest credentials

[V-011]
↓
3Lateral Movement

Reach CORE zone; NTLM relay / SMBv1 against AD

[V-008]
↓
4Privilege Escalation

Zerologon (CVE-2020-1472) resets domain controller machine account -> Domain Admin

[V-095, V-094]
↓
5Impact

Access ERP DB, payroll DB (default sa password), full operations control

[V-007, V-025, V-018]
AC-3

Cloud & Secrets Exposure

No insider needed

Leaked cloud keys and misconfigured public data stores give direct access to backups and databases without touching the campus network at all.

◆ Crown jewelS3 backups, MongoDB / Elasticsearch data stores
1OSINT / Recon

GitHub .env with AWS keys; Terraform state with secrets

[O-014, O-040, O-047]
↓
2Initial Access

Public-write S3 bucket + internet-exposed MongoDB with no auth

[V-037, V-038]
↓
3Data

Elasticsearch cluster exposed, no auth

[V-039]