#!/usr/bin/env bash
# =============================================================================
# IDRBT Security Disclosure — Package Builder
# Creates: IDRBT-CERTIn-Disclosure-<date>.tar.gz
# Contents:
#   README.md                      — Full disclosure, endpoint table, impact
#   collect-evidence.sh            — Runnable evidence collector (chmod +x)
#   idrbt-poc-final.mp4            — Video PoC with TTS commentary + subtitles
#   idrbt-demo-2.sh                — Terminal demo script (automatic mode)
# =============================================================================
set -euo pipefail

DIR=$(dirname "$0")
PKG_NAME="IDRBT-CERTIn-Disclosure-$(date -u '+%Y%m%d')"

echo "Building package: $PKG_NAME.tar.gz"
echo ""

rm -rf "/tmp/$PKG_NAME"
mkdir -p "/tmp/$PKG_NAME"

# ── 1. Video PoC ──
if [ -f "$DIR/idrbt-poc-final.mp4" ]; then
  cp "$DIR/idrbt-poc-final.mp4" "/tmp/$PKG_NAME/idrbt-poc-final.mp4"
  echo "  ✓ idrbt-poc-final.mp4"
fi

# ── 2. Demo script ──
if [ -f "$DIR/idrbt-demo-2.sh" ]; then
  cp "$DIR/idrbt-demo-2.sh" "/tmp/$PKG_NAME/idrbt-demo-2.sh"
  chmod +x "/tmp/$PKG_NAME/idrbt-demo-2.sh"
  echo "  ✓ idrbt-demo-2.sh (runnable terminal demo)"
fi

# ── 3. Evidence collector ──
if [ -f "$DIR/collect-evidence.sh" ]; then
  cp "$DIR/collect-evidence.sh" "/tmp/$PKG_NAME/collect-evidence.sh"
  chmod +x "/tmp/$PKG_NAME/collect-evidence.sh"
  echo "  ✓ collect-evidence.sh (auto-extracts all endpoints)"
fi

# ── 4. README ──
cat "/tmp/$PKG_NAME/README.md" 2>/dev/null || cat > "/tmp/$PKG_NAME/README.md" << 'ENDREADME'
# IDRBT Domain Registrar Portal — Security Vulnerability Disclosure

**Target:** https://registrar.idrbt.ac.in/
**Researcher:** Cashless Consumer
**Disclosed:** 2026-06-08 via CERT-In
**Impact:** 5,576 unique banking personnel credentials exposed, ₹4.72 Cr financial records leaked

---

## Contents

| File | Description |
|------|-------------|
| `idrbt-poc-final.mp4` | Video PoC — terminal recording with TTS commentary and subtitles |
| `idrbt-demo-2.sh` | Automatic terminal demo script (run: `bash idrbt-demo-2.sh \\| tee log.txt`) |
| `collect-evidence.sh` | Full data extraction script — hits all endpoints, saves structured output (run: `bash collect-evidence.sh`) |

## Vulnerability Summary

The IDRBT Domain Registration Portal exposes **33+ REST API endpoints** without authentication. Any internet user can download the complete user database, invoice records, system configuration, and internal portal content.

### Critical — Data Exposure

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/user/all` | 5,462 | Emails, phones, bcrypt password hashes, OTPs, IPs, device fingerprints, roles, 2FA status |
| `GET /api/dr/user/orphan-users` | 1,074 | Same fields — 99.8% Super Admin role (registration bug) |
| `GET /api/dr/user/deleted-users` | 219 | Same fields — records never actually purged |
| `GET /api/dr/user/get/{email}` | per-user | Full record for any email — no auth |
| `GET /api/dr/invoice/getByOrgId/{id}` | 1,535 | ₹4.72 crore billing history, bank names, domain names, payment status, officer contacts |
| `GET /api/dr/billingHistory/all` | variable | Billing records by user ID |

### High — Information Gathering

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/user/verify-user/{email}` | — | Confirms if email exists in system (5 enumeration endpoints) |
| `GET /api/dr/user/getCheck/{email}` | — | User existence check |
| `GET /api/dr/rgtrUser/verify-user/{email}` | — | Registrar user existence |
| `POST /api/dr/user/get-otp` | — | Distinct error message confirms registered users |

### Medium — Infrastructure / Config

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/static/getAll` | 16 config | GST/TDS rates, domain pricing, rebate, email regex, orphan duration |
| `GET /api/dr/departments/all` | 3 depts | Contractor emails (ikcon), IDRBT staff emails |
| `GET /api/departments/{id}` | per-id | Individual department details |
| `GET /api/dr/rgtrUser/getAlltext` | 6 entries | Portal content for Dev/UAT/Prod environments |
| `GET /api/dr/links/all` | 4 links | Portal navigation links |
| `GET /api/dsc/getTokenRequest` | session | DSC/eMudhra session initiation — encrypted but publicly reachable |
| `GET /api/dsc/getCertificateRequest` | payload | eMudhra certificate request proxy (requires token name) |

### Low — Metadata

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/dnssec/algorithmTypes` | 8 types | Supported DNSSEC algorithms |
| `GET /api/dr/dnssec/digestTypes` | 4 types | Supported DNSSEC digest types |
| `GET /api/dr/user/activeUser` | 1 | Active user count |
| `GET /api/dr/notification/count/{userId}` | count | Notification count |
| `GET /api/dr/notification/all/{userId}` | list | Notification list |
| `GET /api/actuator/health` | status | Spring Boot health — confirms tech stack |
| `GET /api/actuator` | links | Actuator endpoint discovery |

## Total: 33+ Unauthenticated Endpoints

## Attack Scenarios

1. **Offline password cracking** — 5,576 bcrypt hashes at 10 rounds → portal access → domain hijacking
2. **Pretext phishing** — "Regarding invoice #29981 for sbi.bank.in renewal..." with bank name, domain, amount, officer name
3. **Credential stuffing** — reused passwords across bank internal systems
4. **Supply chain** — contractor emails (ikcon) for social engineering
5. **User enumeration** — 5 separate endpoints confirm if any email exists in the system

## Systemic Issues

- UAT configuration deployed on production domain (`envName: "UAT"`)
- JWT authentication is cosmetic — frontend sends `Authorization: Bearer` header but backend never validates it
- No mandatory DNSSEC/DMARC/HSTS for .bank.in domains
- No vulnerability disclosure program, no security.txt
- No public tender for vendor (IKCON Technologies)

## Remediation (P0)

1. Block ALL `/api/*` public access at nginx reverse-proxy level immediately
2. Force password reset for all 5,576 affected users
3. Audit nginx access logs for data exfiltration
4. Add server-side JWT validation to ALL endpoints
5. Fix orphan user role assignment bug (Super Admin default)

---

*All testing performed using read-only GET requests. No data was modified or exfiltrated beyond documentation. This disclosure is made in good faith to protect affected banking personnel and financial institutions.*
ENDREADME

echo "  ✓ README.md (full endpoint table + impact analysis)"

# ── 5. Build package ──
cd /tmp
PKG_PATH="/home/workspace/IDRBT/poc-video/$PKG_NAME.tar.gz"
tar -czf "$PKG_PATH" "$PKG_NAME/"
cd - >/dev/null

echo ""
echo "══════════════════════════════════════════════════════════════"
echo "  Package built:"
ls -lh "$PKG_PATH"
echo "══════════════════════════════════════════════════════════════"
echo ""
echo "  Extract: tar -xzf $PKG_NAME.tar.gz"
echo "  Then:    cd $PKG_NAME/"
echo "           bash collect-evidence.sh   # full data extraction"
echo "           bash idrbt-demo-2.sh       # terminal demo"
echo ""