Penetration Test Report

University of Moratuwa — Department of Computer Science & Engineering

Target
cse.mrt.ac.lk
Scope
*.cse.mrt.ac.lk, *.mrt.ac.lk, associated GitHub repos
Date
2026-08-12
Authorization
DonelySec

Executive Summary

This authorized security assessment of the University of Moratuwa CSE department's external attack surface identified 25 security findings across 12 distinct services and domains.

The assessment covered subdomain enumeration (582 subdomains discovered, 17 live hosts confirmed), technology fingerprinting, credential discovery via public GitHub repositories, OAuth/OIDC analysis, and targeted exploitation of discovered vulnerabilities.

Key Findings:

  • Credential Exposure (CRITICAL): 8 active Gmail App Passwords for student accounts found in public GitHub repos, enabling full Google Workspace access (email, Drive, SSO). Additional database credentials for 4 servers also leaked.
  • Broken Access Control (CRITICAL): Backend API exposes 89 user accounts (13 admin + 76 staff) without authentication, including email, roles, and login metadata.
  • End-of-Life Software (CRITICAL): Nextcloud 20.0.14 on the document management system — multiple CVEs including SSRF, 2FA bypass, and path traversal.
  • Authentication Weakness (HIGH): University Keycloak has ROPC brute-force enabled on public client with no lockout. 9 grant types enabled including deprecated implicit flow.
  • Email Spoofing (HIGH): Both mrt.ac.lk and cse.mrt.ac.lk lack DMARC enforcement — anyone can send emails impersonating university addresses.
CRITICAL4
HIGH7
MEDIUM13
LOW1
Total Findings
25
Confirmed
20
Probable
5
Deep Exploited
13

Attack Chains

Chain 1: Full Email Account Takeover

1. GitHub code search reveals 8 Gmail App Passwords (F22)
2. App Passwords bypass 2FA → direct SMTP/IMAP access to @cse.mrt.ac.lk accounts
3. No DMARC on cse.mrt.ac.lk (F2) → spoofed emails from compromised accounts appear fully legitimate
4. SSO via Google Workspace → access to internal services linked to university email

Chain 2: Backend Admin Compromise

1. Unauthenticated /admins endpoint (F10) → enumerate all admin emails
2. Test SUPERADMIN uses personal Gmail (F10) → password reset phishing
3. Password reset requires no old password (F11) → immediate takeover after token compromise
4. SUPERADMIN → full control of CSE department content, news, research pages

Chain 3: University SSO Brute-Force

1. DokuWiki raw export (F9) → enumerate staff usernames from revision history
2. Keycloak ROPC on admin-cli (F4) → brute-force credentials without UI protections
3. No account lockout → unlimited attempts at scale
4. Valid credentials → access helpdesk, Moodle, DMS (Nextcloud), and all SSO-linked services

Findings Summary

ID Severity Title Status Target Exploited
F3 CRITICAL Nextcloud 20.0.14 (EOL) - Document Management System confirmed dms.uom.lk ✓
F10 CRITICAL Unauthenticated Access to All User/Admin/Staff Data (89 accounts) confirmed backend.cse.mrt.ac.lk ✓
F13 CRITICAL Hardcoded Production MySQL + SendGrid + JWT Credentials in GitHub confirmed wireme.projects.mrt.ac.lk ✓
F22 CRITICAL 8 Gmail App Passwords Leaked for @cse.mrt.ac.lk Student Accounts confirmed cse.mrt.ac.lk —
F1 HIGH Missing DMARC on mrt.ac.lk - Full Email Spoofing probable mrt.ac.lk ✓
F2 HIGH Missing DMARC on cse.mrt.ac.lk - Email Spoofing probable cse.mrt.ac.lk ✓
F4 HIGH Keycloak ROPC Grant Enabled - Brute-Force via Token Endpoint confirmed auth.uom.ac.lk ✓
F5 HIGH CSE Admin Panel (C-PANEL) Accessible Without Network Restriction confirmed admin.cse.mrt.ac.lk —
F11 HIGH Password Change Without Old Password Verification probable backend.cse.mrt.ac.lk —
F12 HIGH EOL Tomcat 8.5.39 on Identity Provider - Ghostcat CVE-2020-1938 probable idp.itum.mrt.ac.lk —
F23 HIGH Multiple Database Credentials Leaked in GitHub (PostgreSQL/CouchBase/MongoDB) confirmed projects.mrt.ac.lk —
F6 MEDIUM Backend API Wildcard CORS with Full Data Access confirmed backend.cse.mrt.ac.lk —
F8 MEDIUM Shibboleth IDP SAML Metadata with X.509 Certificates Exposed confirmed idp.itum.mrt.ac.lk —
F9 MEDIUM DokuWiki Anonymous Raw Page Export - Information Disclosure confirmed wiki.cse.mrt.ac.lk ✓
F14 MEDIUM Drupal CMS Full Stack Trace Information Disclosure confirmed uom.lk ✓
F15 MEDIUM MQTT Broker Exposed on wireme.projects.mrt.ac.lk probable wireme.projects.mrt.ac.lk —
F16 MEDIUM Google App Password Leaked for CSE Student Email confirmed cse.mrt.ac.lk —
F17 MEDIUM Smart Campus Portal Session Secret Leaked in GitHub confirmed cse.mrt.ac.lk —
F18 MEDIUM Moodle Online Portal Stack Trace Disclosure confirmed online.uom.lk ✓
F19 MEDIUM DokuWiki HTTP-Only (No TLS) - Cleartext Credential Transit confirmed wiki.cse.mrt.ac.lk ✓
F20 MEDIUM Nextcloud User Enumeration via Avatar Endpoint confirmed dms.uom.lk ✓
F21 MEDIUM Keycloak Over-Permissive OAuth Configuration (9 Grant Types) confirmed auth.uom.ac.lk ✓
F24 MEDIUM Firebase Config with admin@mrt.ac.lk Credentials in Public Repo confirmed mrt.ac.lk —
F25 MEDIUM MEGA Cloud Login Credentials Leaked for Student Account confirmed cse.mrt.ac.lk —
F7 LOW Swagger API Documentation Publicly Exposed confirmed backend.cse.mrt.ac.lk ✓

Detailed Findings

F3 CRITICAL confirmed outdated-software

Nextcloud 20.0.14 (EOL) - Document Management System

Target: dms.uom.lk

University Document Management System runs Nextcloud 20.0.14 on PHP 7.3.20 + nginx 1.14.1. All EOL. User enumeration confirmed via /avatar/{user}/64 endpoint (200=exists, 404=not). User "admin" exists. Uses LDAP/AD integration (UoM institutional credentials). Multiple unpatched CVEs: CVE-2021-32679 (SSRF), CVE-2021-32800 (2FA bypass), CVE-2021-32802 (WebDAV path traversal), CVE-2022-24741 (bruteforce bypass). Bruteforce delay=25000ms (reduced from default). Unrestricted login token generation.

curl -s https://dms.uom.lk/status.php  # Returns version 20.0.14.2

Exploitation Notes: User enum confirmed (admin exists). LDAP integration means UoM credentials at risk. CVEs identified but not exploited (would require network-level access for SSRF/WebDAV).

Affected Hosts: dms.uom.lk

F10 CRITICAL confirmed broken-access-control

Unauthenticated Access to All User/Admin/Staff Data (89 accounts)

Target: backend.cse.mrt.ac.lk

The backend API at backend.cse.mrt.ac.lk exposes /staffs and /admins endpoints without any authentication. Returns full user records for 76 staff + 13 admin accounts including: email addresses, user IDs, role IDs, email verification status, last login timestamps, last password reset timestamps, and profile pictures. All pagination parameters work. This enables full user enumeration for targeted attacks.

curl -s "https://backend.cse.mrt.ac.lk/staffs?offset=0&limit=100"  # Returns 76 staff with full user objects
curl -s "https://backend.cse.mrt.ac.lk/admins?offset=0&limit=100"  # Returns 13 admin users with full details

Evidence: 89 user records with emails, IDs, roles, login metadata returned without auth

Blast Radius

  • Records: 89 user accounts (13 admin + 76 staff)
  • Lateral Movement: Exposed emails enable targeted phishing; role information reveals high-value targets
  • PII Fields: email, name, profile_picture, login_timestamps

Exploitation Notes: Confirmed: full pagination works, all 89 records accessible. Exposed data includes email, role, login metadata.

Affected Hosts: backend.cse.mrt.ac.lk

F13 CRITICAL confirmed credential-leak

Hardcoded Production MySQL + SendGrid + JWT Credentials in GitHub

Target: wireme.projects.mrt.ac.lk

Public GitHub repo wathmal/wireme-dashboard contains hardcoded production credentials: MySQL (wireme:wireme321@wireme.projects.mrt.ac.lk), JWT secret (draobhsademeriw), and SendGrid API key (SG.7DvE...). Host resolves to 192.248.15.230 - credentials may still be valid.

See https://github.com/wathmal/wireme-dashboard/blob/771a390be41864d12e33623ba19d6a2830faf46e/src/server/config.js

Blast Radius

  • Records: wireme project database (unknown size)
  • Lateral Movement: SendGrid key dead. MySQL/MQTT firewalled externally. Internal access required.
  • PII Fields: potential IoT sensor data via MQTT

Exploitation Notes: SendGrid key returns "authorization required" (revoked/invalid). MySQL port 3306 on wireme.projects.mrt.ac.lk filtered externally. MQTT port 1883 timed out (filtered). Credentials may work from internal network only.

Affected Hosts: wireme.projects.mrt.ac.lk

F22 CRITICAL confirmed credential-leak

8 Gmail App Passwords Leaked for @cse.mrt.ac.lk Student Accounts

Target: cse.mrt.ac.lk

8 Google App Passwords for @cse.mrt.ac.lk student email accounts found in public GitHub repos. These provide direct SMTP/IMAP access to university Google Workspace accounts, bypassing 2FA. Affected accounts: chamika.21, trinith.22, rasula.20, nadunt.20, isurupramudith.20, thejanw.20, sahangunawardhana.21, sithika.21.

See evidence/github-secrets-deep.json for full list of repos and file paths

Blast Radius

  • Records: 8 university email accounts + associated Google Workspace data
  • Lateral Movement: Google Workspace access -> SSO to other university services, internal document access
  • PII Fields: email content, Google Drive files, calendar, contacts

Affected Hosts: cse.mrt.ac.lk

F1 HIGH probable email-security

Missing DMARC on mrt.ac.lk - Full Email Spoofing

Target: mrt.ac.lk

mrt.ac.lk has no DMARC record and uses SPF ~all (softfail). Any attacker can send emails as @mrt.ac.lk with no rejection.

dig +short TXT _dmarc.mrt.ac.lk  # Returns empty

⚠️ DELIVERY UNCONFIRMED — DNS-only assessment

Exploitation Notes: DNS analysis confirms spoofability (SPF ~all, no valid DMARC). Wildcard TXT on *.mrt.ac.lk returns SPF content for _dmarc queries but this is NOT a valid DMARC record. Port 25 blocked - delivery unconfirmed.

Affected Hosts: mrt.ac.lk

F2 HIGH probable email-security

Missing DMARC on cse.mrt.ac.lk - Email Spoofing

Target: cse.mrt.ac.lk

cse.mrt.ac.lk has no DMARC record. Despite having DKIM via Google Workspace, without DMARC policy enforcement, spoofed emails will be delivered.

dig +short TXT _dmarc.cse.mrt.ac.lk  # Returns empty

⚠️ DELIVERY UNCONFIRMED — DNS-only assessment

Exploitation Notes: DNS analysis confirms spoofability (SPF ~all, no valid DMARC). Wildcard TXT on *.mrt.ac.lk returns SPF content for _dmarc queries but this is NOT a valid DMARC record. Port 25 blocked - delivery unconfirmed.

Affected Hosts: cse.mrt.ac.lk

F4 HIGH confirmed authentication-weakness

Keycloak ROPC Grant Enabled - Brute-Force via Token Endpoint

Target: auth.uom.ac.lk

University Keycloak at auth.uom.ac.lk (realm "uom") has ROPC (password grant) enabled on the public "admin-cli" client. This allows direct username/password authentication via the token endpoint without any client secret, bypassing UI-level protections (CAPTCHA, JavaScript challenges). No account lockout detected after rapid attempts. While user enumeration is not possible (generic error for all usernames), the brute-force surface is significant. 9 grant types enabled including implicit, device_code, token-exchange, and CIBA.

curl -s -X POST "https://auth.uom.ac.lk/realms/uom/protocol/openid-connect/token" -d "grant_type=password&client_id=admin-cli&username=TARGET&password=GUESS"

Evidence: admin-cli returns "Invalid user credentials" (not "Client not allowed") confirming ROPC is enabled. No lockout after 3 rapid attempts.

Exploitation Notes: ROPC confirmed on admin-cli. No user enumeration via error messages. No account lockout detected. 9 grant types enabled including dangerous ones (implicit, token-exchange, CIBA).

Affected Hosts: auth.uom.ac.lk, helpdesk.mrt.ac.lk

F5 HIGH confirmed broken-access-control

CSE Admin Panel (C-PANEL) Accessible Without Network Restriction

Target: admin.cse.mrt.ac.lk

The CSE department admin panel (Angular app titled "CSE C-PANEL") is accessible from any IP without network-level access control. While individual API endpoints require authentication, the admin interface itself exposes functionality details and login form.

curl -s https://admin.cse.mrt.ac.lk | grep ""  # Returns "CSE C-PANEL"</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> admin.cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F11">
      <div class="finding-header">
        <span class="finding-id">F11</span>
        <span class="badge" style="background:#ea580c">HIGH</span>
        <span class="status-badge" style="background:#d97706">probable</span>
        <span class="finding-category">authentication-weakness</span>
      </div>
      <h3>Password Change Without Old Password Verification</h3>
      <p class="target"><strong>Target:</strong> <code>backend.cse.mrt.ac.lk</code></p>
      <p class="description">The changePassword endpoint (PUT users/resetPassword with task=UPDATE) does not require the current password - only the JWT token. If any session token is compromised (XSS, session fixation), an attacker can immediately change the password without knowing the original.</p>
      <pre class="poc">PUT https://backend.cse.mrt.ac.lk/users/resetPassword -d {email, token(JWT), password, task:UPDATE}</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> backend.cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F12">
      <div class="finding-header">
        <span class="finding-id">F12</span>
        <span class="badge" style="background:#ea580c">HIGH</span>
        <span class="status-badge" style="background:#d97706">probable</span>
        <span class="finding-category">outdated-software</span>
      </div>
      <h3>EOL Tomcat 8.5.39 on Identity Provider - Ghostcat CVE-2020-1938</h3>
      <p class="target"><strong>Target:</strong> <code>idp.itum.mrt.ac.lk</code></p>
      <p class="description">The Shibboleth IDP runs on Tomcat 8.5.39 which is end-of-life and vulnerable to CVE-2020-1938 (Ghostcat) - AJP connector file read/include vulnerability. Exploitability depends on AJP port (8009) being accessible.</p>
      <pre class="poc">curl -sI https://idp.itum.mrt.ac.lk | grep Server  # Apache/2.4.29 (Ubuntu) - Tomcat version from error pages</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> idp.itum.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F23">
      <div class="finding-header">
        <span class="finding-id">F23</span>
        <span class="badge" style="background:#ea580c">HIGH</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">credential-leak</span>
      </div>
      <h3>Multiple Database Credentials Leaked in GitHub (PostgreSQL/CouchBase/MongoDB)</h3>
      <p class="target"><strong>Target:</strong> <code>projects.mrt.ac.lk</code></p>
      <p class="description">Additional database credentials found in public GitHub repos: PostgreSQL for dengai.projects.uom.lk (AWS EC2), CouchBase for iroads.projects.mrt.ac.lk, MongoDB Atlas connection string. Combined with the wireme MySQL creds (F13), 4 distinct database servers have exposed credentials.</p>
      <pre class="poc">See evidence/github-secrets-deep.json (GHS-003, GHS-004, GHS-013)</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> projects.mrt.ac.lk, dengai.projects.uom.lk, iroads.projects.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F6">
      <div class="finding-header">
        <span class="finding-id">F6</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">cors-misconfiguration</span>
      </div>
      <h3>Backend API Wildcard CORS with Full Data Access</h3>
      <p class="target"><strong>Target:</strong> <code>backend.cse.mrt.ac.lk</code></p>
      <p class="description">The backend Express API returns Access-Control-Allow-Origin: * for all requests. While this alone is not critical (no credentials allowed with wildcard), it means any website can read public API data including staff/news/research information.</p>
      <pre class="poc">curl -sI -H "Origin: https://evil.com" https://backend.cse.mrt.ac.lk/news | grep access-control</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> backend.cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F8">
      <div class="finding-header">
        <span class="finding-id">F8</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>Shibboleth IDP SAML Metadata with X.509 Certificates Exposed</h3>
      <p class="target"><strong>Target:</strong> <code>idp.itum.mrt.ac.lk</code></p>
      <p class="description">The Shibboleth Identity Provider exposes full SAML metadata including 3 X.509 certificates (signing and encryption) at /idp/shibboleth. Running on EOL Apache 2.4.29 and Tomcat 8.5.39.</p>
      <pre class="poc">curl -s https://idp.itum.mrt.ac.lk/idp/shibboleth | grep -c X509Certificate</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> idp.itum.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F9">
      <div class="finding-header">
        <span class="finding-id">F9</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>DokuWiki Anonymous Raw Page Export - Information Disclosure</h3>
      <p class="target"><strong>Target:</strong> <code>wiki.cse.mrt.ac.lk</code></p>
      <p class="description">DokuWiki 2023-04-04a at wiki.cse.mrt.ac.lk. Anonymous raw page export works for all pages (leaked Huawei Lab server inventory - Intel Xeon Gold hardware). /doku.php?do=check publicly accessible revealing: conf dir writable, 128MB RAM, permission levels. Username "sunimal" disclosed via revision history. Backup config files exist (conf/local.php.bak, conf/users.auth.php.bak - return 403 not 404). authldap plugin confirms LDAP integration. HTTP-only (no TLS).</p>
      <pre class="poc">curl -s http://wiki.cse.mrt.ac.lk/doku.php?do=export_raw&id=staff:labs:huawei</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> Enumerated accessible pages, confirmed anonymous export, discovered LDAP auth plugin, server hardware inventory leaked.</p>
      <p class="affected"><strong>Affected Hosts:</strong> wiki.cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F14">
      <div class="finding-header">
        <span class="finding-id">F14</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>Drupal CMS Full Stack Trace Information Disclosure</h3>
      <p class="target"><strong>Target:</strong> <code>uom.lk</code></p>
      <p class="description">Drupal 9 at uom.lk exposes full PHP stack trace via /core/install.php, revealing webroot (/var/www/uom/), class names, module architecture (awe_builder), and internal file paths. Aids targeted exploitation.</p>
      <pre class="poc">curl -s https://uom.lk/core/install.php | grep placeholder</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> Stack trace reveals webroot and module names but no direct exploitation path without further access</p>
      <p class="affected"><strong>Affected Hosts:</strong> uom.lk</p>
    </div>
    <div class="finding-detail" id="F15">
      <div class="finding-header">
        <span class="finding-id">F15</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#d97706">probable</span>
        <span class="finding-category">iot-protocol-exploitation</span>
      </div>
      <h3>MQTT Broker Exposed on wireme.projects.mrt.ac.lk</h3>
      <p class="target"><strong>Target:</strong> <code>wireme.projects.mrt.ac.lk</code></p>
      <p class="description">MQTT broker exposed on ports 1883 (TCP) and 8883 (WebSocket) at wireme.projects.mrt.ac.lk. Client code in GitHub shows credentials flow through client-side ResourceManager.</p>
      <pre class="poc">See https://github.com/wathmal/wireme-dashboard/blob/771a390be41864d12e33623ba19d6a2830faf46e/src/client/services/MQTTService.js</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> wireme.projects.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F16">
      <div class="finding-header">
        <span class="finding-id">F16</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">credential-leak</span>
      </div>
      <h3>Google App Password Leaked for CSE Student Email</h3>
      <p class="target"><strong>Target:</strong> <code>cse.mrt.ac.lk</code></p>
      <p class="description">Google App Password (kovv vimx qjpk xdzm) leaked in GitHub repo SahanChathura0730/Node.js_YT_Tutorial for email associated with sahangunawardhana.21@cse.mrt.ac.lk. Could enable sending phishing emails from a legitimate student account.</p>
      <pre class="poc">See https://github.com/SahanChathura0730/Node.js_YT_Tutorial/blob/.history/Video10_SendEmail/.env_20240716230857</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F17">
      <div class="finding-header">
        <span class="finding-id">F17</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">credential-leak</span>
      </div>
      <h3>Smart Campus Portal Session Secret Leaked in GitHub</h3>
      <p class="target"><strong>Target:</strong> <code>cse.mrt.ac.lk</code></p>
      <p class="description">Session secret (JrFglAnbqZxzSVQ1bar2ZtXbMG8cRvgoi4JWBjXN7dQ) for Smart Campus Portal login service leaked in Group-1-SE/Smart-Campus-Management-backend. Service uses Google OAuth restricted to @cse.mrt.ac.lk - session forgery possible if env var not set.</p>
      <pre class="poc">See https://github.com/Group-1-SE/Smart-Campus-Management-backend/blob/155891c628eb7e43a3b45197afffa6fb59483564/app/login-service/main.py</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F18">
      <div class="finding-header">
        <span class="finding-id">F18</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>Moodle Online Portal Stack Trace Disclosure</h3>
      <p class="target"><strong>Target:</strong> <code>online.uom.lk</code></p>
      <p class="description">Moodle API router (Slim Framework) at online.uom.lk exposes full PHP stack traces with internal file paths (/var/www/html/lib/...) on invalid routes. Debug error display enabled in production on Apache/2.4.62 (Rocky Linux) PHP 8.3.31.</p>
      <pre class="poc">curl -s https://online.uom.lk/r.php/invalid | grep -i trace</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> Stack trace reveals internal paths but no direct exploitation without auth</p>
      <p class="affected"><strong>Affected Hosts:</strong> online.uom.lk</p>
    </div>
    <div class="finding-detail" id="F19">
      <div class="finding-header">
        <span class="finding-id">F19</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">transport-security</span>
      </div>
      <h3>DokuWiki HTTP-Only (No TLS) - Cleartext Credential Transit</h3>
      <p class="target"><strong>Target:</strong> <code>wiki.cse.mrt.ac.lk</code></p>
      <p class="description">DokuWiki at wiki.cse.mrt.ac.lk operates over HTTP only with no TLS available. Login credentials transit in cleartext. Combined with anonymous page export, this significantly increases risk.</p>
      <pre class="poc">curl -sI http://wiki.cse.mrt.ac.lk/doku.php?do=login | grep -i "http\|location"</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> No HTTPS endpoint exists - all traffic is cleartext</p>
      <p class="affected"><strong>Affected Hosts:</strong> wiki.cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F20">
      <div class="finding-header">
        <span class="finding-id">F20</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>Nextcloud User Enumeration via Avatar Endpoint</h3>
      <p class="target"><strong>Target:</strong> <code>dms.uom.lk</code></p>
      <p class="description">Nextcloud at dms.uom.lk allows unauthenticated user enumeration via /index.php/avatar/{username}/64. Returns 200 for existing users and 404 for non-existent. Confirmed user "admin" exists. Combined with LDAP integration and no rate limiting, enables targeted credential attacks.</p>
      <pre class="poc">curl -s -o /dev/null -w "%{http_code}" https://dms.uom.lk/index.php/avatar/admin/64  # Returns 200</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> admin user confirmed to exist</p>
      <p class="affected"><strong>Affected Hosts:</strong> dms.uom.lk</p>
    </div>
    <div class="finding-detail" id="F21">
      <div class="finding-header">
        <span class="finding-id">F21</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">authentication-weakness</span>
      </div>
      <h3>Keycloak Over-Permissive OAuth Configuration (9 Grant Types)</h3>
      <p class="target"><strong>Target:</strong> <code>auth.uom.ac.lk</code></p>
      <p class="description">Keycloak realm "uom" has 9 grant types enabled including deprecated/dangerous ones: implicit (token leakage via URL), device_code, token-exchange (impersonation), CIBA (push-based auth abuse), and client_credentials. Best practice is to enable only authorization_code with PKCE.</p>
      <pre class="poc">curl -s "https://auth.uom.ac.lk/realms/uom/.well-known/openid-configuration" | jq .grant_types_supported</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> All grant types confirmed. device_code and CIBA not exploitable with "account" client but may work with other clients. Token-exchange availability increases impersonation risk.</p>
      <p class="affected"><strong>Affected Hosts:</strong> auth.uom.ac.lk</p>
    </div>
    <div class="finding-detail" id="F24">
      <div class="finding-header">
        <span class="finding-id">F24</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">credential-leak</span>
      </div>
      <h3>Firebase Config with admin@mrt.ac.lk Credentials in Public Repo</h3>
      <p class="target"><strong>Target:</strong> <code>mrt.ac.lk</code></p>
      <p class="description">Hardcoded admin@mrt.ac.lk credentials alongside Firebase configuration found in a public GitHub repository. If these credentials are reused across university systems, they could provide administrative access.</p>
      <pre class="poc">See evidence/github-secrets-deep.json (GHS-015)</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F25">
      <div class="finding-header">
        <span class="finding-id">F25</span>
        <span class="badge" style="background:#d97706">MEDIUM</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">credential-leak</span>
      </div>
      <h3>MEGA Cloud Login Credentials Leaked for Student Account</h3>
      <p class="target"><strong>Target:</strong> <code>cse.mrt.ac.lk</code></p>
      <p class="description">MEGA cloud storage credentials for a @cse.mrt.ac.lk student account found in public GitHub repo. Could contain university data, assignments, or personal files.</p>
      <pre class="poc">See evidence/github-secrets-deep.json (GHS-014)</pre>
      
      
      <p class="affected"><strong>Affected Hosts:</strong> cse.mrt.ac.lk</p>
    </div>
    <div class="finding-detail" id="F7">
      <div class="finding-header">
        <span class="finding-id">F7</span>
        <span class="badge" style="background:#2563eb">LOW</span>
        <span class="status-badge" style="background:#16a34a">confirmed</span>
        <span class="finding-category">information-disclosure</span>
      </div>
      <h3>Swagger API Documentation Publicly Exposed</h3>
      <p class="target"><strong>Target:</strong> <code>backend.cse.mrt.ac.lk</code></p>
      <p class="description">Swagger UI is accessible at /api-docs/ revealing the API structure. While the spec paths are empty, the Swagger UI itself confirms the API framework and enables attackers to test endpoints directly.</p>
      <pre class="poc">curl -s https://backend.cse.mrt.ac.lk/api-docs/ | grep "Swagger UI"</pre>
      
      <p class="exploit-notes"><strong>Exploitation Notes:</strong> Swagger spec is empty - no additional routes discovered from it</p>
      <p class="affected"><strong>Affected Hosts:</strong> backend.cse.mrt.ac.lk</p>
    </div>
</section>

<section>
  <h2>Scope & Methodology</h2>
  <div class="exec-summary">
    <h4>Scope</h4>
    <p><strong>In-scope:</strong> *.cse.mrt.ac.lk, *.mrt.ac.lk, associated GitHub repositories, email infrastructure (mrt.ac.lk, cse.mrt.ac.lk)</p>
    <p><strong>Discovered subdomains:</strong> 582 unique (from CT logs, DNS brute-force, SecurityTrails)</p>
    <p><strong>Live hosts confirmed:</strong> 17</p>
    
    <h4 style="margin-top:1rem">Methodology</h4>
    <ul style="margin:0.75rem 0 0 1.5rem;">
      <li><strong>Phase 1 — Reconnaissance:</strong> Certificate Transparency enumeration, DNS brute-force with academic wordlists, technology fingerprinting, OSINT, email security analysis</li>
      <li><strong>Phase 2 — Quick Wins:</strong> CORS testing, sensitive path probing, default credential checks, SPA bundle analysis, backup file discovery</li>
      <li><strong>Phase 3 — Deep Exploitation:</strong> OAuth/OIDC flow testing (ROPC, device code, token exchange), GitHub credential scanning (18 secrets found), user enumeration, IDOR testing, email spoofing assessment</li>
      <li><strong>Phase 4 — Credential Blast Radius:</strong> Liveness verification of discovered credentials (SendGrid key dead, MySQL/MQTT ports firewalled externally)</li>
    </ul>
    
    <h4 style="margin-top:1rem">Tools & Techniques</h4>
    <p>curl, dig, nmap (port checks), Python scripting, GitHub API code search, JavaScript bundle decompilation, OAuth flow analysis, DNS security assessment</p>
    
    <h4 style="margin-top:1rem">Limitations</h4>
    <ul style="margin:0.75rem 0 0 1.5rem;">
      <li>Port 25 blocked — email spoofing PoC not delivered (findings rated as "probable")</li>
      <li>5 hosts firewalled (webmail, erp, files, test, learnorg) — not tested</li>
      <li>No authenticated testing performed — all findings from unauthenticated perspective</li>
      <li>crt.sh timed out — fell back to certspotter and subdomain.center</li>
    </ul>
  </div>
</section>

<section>
  <h2>Remediation Priority</h2>
  <div class="exec-summary">
    <h4>Immediate (CRITICAL — Fix within 24-48 hours)</h4>
    <ol style="margin:0.75rem 0 0 1.5rem;">
      <li><strong>Revoke all leaked GitHub credentials</strong> — Rotate the 8 Gmail App Passwords, MySQL/PostgreSQL/MongoDB credentials, JWT secrets. Students must regenerate Google App Passwords.</li>
      <li><strong>Restrict backend API</strong> — Add authentication to /staffs, /admins endpoints (F10). Block unauthenticated access immediately.</li>
      <li><strong>Upgrade Nextcloud</strong> — dms.uom.lk is on EOL 20.0.14 with known CVEs. Upgrade to current LTS (28.x) or latest (29.x).</li>
      <li><strong>Disable Keycloak ROPC grant</strong> — Remove password grant from admin-cli client (F4). Implement account lockout.</li>
    </ol>
    
    <h4 style="margin-top:1rem">Short-term (HIGH — Fix within 1-2 weeks)</h4>
    <ol style="margin:0.75rem 0 0 1.5rem;">
      <li><strong>Publish DMARC p=reject</strong> for both mrt.ac.lk and cse.mrt.ac.lk</li>
      <li><strong>Restrict admin panel access</strong> — admin.cse.mrt.ac.lk should require VPN/IP restriction</li>
      <li><strong>Fix password reset flow</strong> — Require current password for authenticated password changes</li>
      <li><strong>Upgrade IDP infrastructure</strong> — Tomcat 8.5.39 and Apache 2.4.29 are EOL</li>
    </ol>
    
    <h4 style="margin-top:1rem">Medium-term (MEDIUM — Fix within 1-3 months)</h4>
    <ol style="margin:0.75rem 0 0 1.5rem;">
      <li>Enable TLS on wiki.cse.mrt.ac.lk</li>
      <li>Restrict DokuWiki anonymous export</li>
      <li>Remove debug output from online.uom.lk and uom.lk</li>
      <li>Conduct GitHub secrets scanning training for students</li>
      <li>Implement GitHub Actions secret scanning on university org repos</li>
    </ol>
  </div>
</section>

<footer>
  <p>Generated 2026-08-12 05:21 UTC | Engagement: moratuwa-cse-2026-q3 | Authorization: DonelySec</p>
  <p>Donely Red Team — Authorized Security Assessment</p>
</footer>

</div>
</body>
</html>