Security of Indian Government Websites
Indian government websites have historically had serious security issues. Here's what ethical hackers have responsibly disclosed.
Common Issues Found
- 🔴 SQL Injection: Found in multiple state government portals
- 🔴 Default Credentials: Admin panels with admin/admin
- 🔴 Exposed Databases: MongoDB and Elasticsearch without auth
- 🔴 IDOR: Access any citizen's data by changing ID
- 🔴 No HTTPS: Many portals still served over HTTP
- 🔴 Outdated Software: Running 10+ year old server software
Real Incidents (Publicly Reported)
- 📌 CoWIN data allegedly accessible via API (2023)
- 📌 AIIMS ransomware attack — patient data compromised
- 📌 Multiple state education portals with SQLi
- 📌 Railway booking data exposed via API
India's Cybersecurity Infrastructure
- CERT-In: Indian Computer Emergency Response Team
- NCIIPC: National Critical Information Infrastructure Protection Centre
- IT Act 2000: Legal framework for cybercrime
- Responsible Disclosure: Report to CERT-In or NCIIPC
How to Report Vulnerabilities Legally
- Document the vulnerability with screenshots
- Report to CERT-In: incident@cert-in.org.in
- Do NOT access, modify, or exfiltrate any data
- Wait for acknowledgment before disclosure
Careers in Government Cybersecurity
- CERT-In Analyst: ₹8-15 LPA
- Cyber Police (Technical): ₹6-12 LPA
- Defense Cybersecurity: ₹10-25 LPA
🔥 Learn responsible hacking at Code Hacker →