Security Assessment of the World Monitor application
“Your team needs to act as ethical cybersecurity analysts to audit the open-source 'World Monitor' application. You must uncover security flaws in its authentication, APIs, and data handling, and then provide clear proof-of-concept exploits and professional patch recommendations.”
Deconstructed Problem Blueprint
WHAT TO BUILD?
A comprehensive security assessment toolkit and automated vulnerability reporting dashboard built around the target World Monitor application repository.
WHO IS IT FOR?
Security analysts, system administrators, and NTRO evaluation officials responsible for securing critical intelligence and real-time monitoring software.
WHY DOES IT EXIST?
Web and mobile monitoring platforms often suffer from overlooked API vulnerabilities, weak session controls, and improper input validation, which malicious actors can exploit to compromise national intelligence dashboards or disrupt operations.
INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE
Target application source code from GitHub, live deployment at worldmonitor.app, HTTP traffic proxies (Burp Suite/OWASP ZAP), and threat intelligence feeds.
Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), manual penetration testing, threat modeling, and CVSS severity score calculation.
An exhaustive Vulnerability Assessment and Penetration Testing (VAPT) report containing titles, descriptions, affected components, severity ratings, step-by-step reproduction guides, safe proof-of-concept exploits, and precise code-level remediations.
CONSTRAINTS
- Must strictly operate on authorized local or sandbox testing instances.
- No disruption or unauthorized scanning of live public production users or data.
- Compliance with ethical hacking guidelines and responsible disclosure principles.
JURY METRICS
- Accuracy and completeness of vulnerability identification.
- Clarity and reproducibility of safe Proof-of-Concept (PoC) exploits.
- Practicality and code-level precision of remediation strategies.
- Quality and layout of the final professional security report dashboard.
CORE BOTTLENECK
Systematically auditing complex JavaScript/Node.js or Python backend logic without missing subtle logical access control flaws or multi-step API authorization bypasses.
Why You Should Choose This PS (Pros)
- Directly ties into national security infrastructure with NTRO as the problem owner.
- Clear, actionable success criteria with defined deliverables (VAPT report format).
- No heavy hardware dependencies—pure software, web security, and code auditing focus.
Challenges & Risks to Watch (Cons)
- Vulnerabilities in the open-source target might be shallow or already patched, requiring deep custom fuzzing.
- Crowded category if teams only submit a basic automated scanner report instead of high-value manual logic findings.
Recommended Tech Stack & Grand Finale Features
Killer Features to Impress the SIH Jury
View Official SIH 2026 Portal Raw Text▼
As a security analyst, the task is to evaluate the application's security posture and identify vulnerabilities that could compromise the confidentiality, integrity, or availability of the system.
For each vulnerability discovered, provide: