TSBIE Auth
Vulnerability PoC
Demonstrating how missing rate-limiting and DOB-only authentication on public student portals enables automated credential recovery — without any server-side protection.
No Rate Limiting
Unlimited automated requests with zero throttling, CAPTCHA, or lockout mechanism.
CriticalDOB Enumeration
Authentication relies solely on date of birth — a low-entropy value easily brute-forced.
HighPII Exposure
Name, photo, college, exam center and subjects accessible to any unauthenticated requester.
HighRemediation
CAPTCHA, OTP verification, and rate limiting would fully mitigate this attack vector.
Fix AvailableLaunch Audit
Configure the automated recovery parameters below
Audit in Progress
Record Located
Hall ticket successfully recovered from the TSBIE portal
Methodology
Identify the target
Provide the 10-digit TSBIE roll number for the record to be audited.
Define the enumeration range
Set the DOB range to test. 2008–2009 covers the majority of current Inter students.
Execute the latency test
The tool submits automated requests. Setting delay to 0ms demonstrates the complete absence of server-side throttling.
Retrieve the record
On a successful match, the full hall ticket is returned — confirming the vulnerability is exploitable.
Vulnerability Details
Research Notes
What data is exposed by this vulnerability?
Full name, father's and mother's name, date of birth, photograph, signature, college name, exam center, subjects and examination schedule.
How quickly can the enumeration complete?
With 0ms request interval, a full year of dates completes in approximately 5–6 minutes. This demonstrates the severity of the missing rate-limit control.
Does the portal detect or block automated requests?
No. As of the time of this research, the TSBIE portal has no rate limiting, CAPTCHA, or request throttling in place.
What is the recommended remediation?
Implement server-side rate limiting (e.g. 5 requests/minute per IP), add CAPTCHA on the form, and introduce OTP-based secondary verification tied to a registered mobile number.
Is this tool legal to use?
This tool is intended for authorized security research, personal data recovery, and educational purposes only. Using it to access third-party data without consent may violate the IT Act, 2000 (India) and other applicable laws.