MEDIUM · refiner

Numaligarh Refinery Limited

2026-10-06 passive check: availability unconfirmed; TLS expiry unconfirmed; header state unconfirmed.

nrl.co.inbaseline scan 2026-04-27 · daily passive check 2026-10-06 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-06

score 62

Availability

request timed out

TLS

unknown

Headers

6 missing · 0 permissive

Email auth

SPF strict · DMARC quarantine

62

Baseline score · 2026-04-27

Watch

Historical findings · 2026-04-27

  • 0145+ subdomains visible in public CT logs — full infrastructure topology mappable from outside
  • 02VPN gateway (vpn.nrl.co.in) and AD-related service (adss.nrl.co.in) named publicly
  • 03Document management exposed across dev/uat/prod tiers (ieddms.*)
  • 04Self-hosted RAG/LLM tool visible (open-web-ui.nrlrag) — introduces AI-specific threat surface
  • 05Public tender PDFs include Enterprise Risk Management Framework (governance content alongside tender attachments)
  • 06No breach evidence in HIBP, IntelX, GitHub code search, paste archives, or S3/Azure bucket guessing
  • 07Email auth strong (DMARC p=quarantine, strict SPF)

TLS security

unknown

Issuer
Unavailable

TLS connection timed out

Email authentication

SPF
strict
DKIM
present
DMARC
quarantine

Hardening headers

0 / 0 / 6present/permissive/missing

  • HSTSmissing
  • CSPmissing
  • X-Framemissing
  • X-Content-Typemissing
  • Referrer-Policymissing
  • Permissions-Policymissing

Lookalike domains

  • nrl.co.com→ 169.60.151.233 (RIPE-allocated cloud, typosquat cluster)
  • nrl.in→ 54.195.35.206 (third-party)
  • nrl.com

    Australian National Rugby League — distinct org

Public topology · CT logs

45 total · 10 sensitive

nrl.co.in
Authentication
  • vpn.nrl.co.in
  • adss.nrl.co.in
Dev / Test / UAT
  • ieddms.dev.nrl.co.in
  • ieddms.uat.nrl.co.in
  • mgpnrl.dev.nrl.co.in
  • mgptest.nrl.co.in
Document mgmt
  • ieddms.prod.nrl.co.in
API / AI
  • open-web-ui.nrlrag.nrl.co.in
Portals
  • b2b.nrl.co.in
Applications
  • hmis.nrl.co.in

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

What is the firmware version of the NRL VPN appliance, and is it patched against the KEV-listed pre-authentication RCE for that brand?

Active fingerprints · per host

  • hmis.nrl.co.inEOL × 3

    Apache 2.4.6 + PHP 7.4.28 + OpenSSL 1.0.2k-fips

    • ⚠ PHP 7.4 EOL 2022-11-28
    • ⚠ OpenSSL 1.0.2 EOL 2019-12-31
    • ⚠ Apache 2.4.6 very old
  • nrlportal.nrl.co.inEOL × 3

    Apache 2.4.6 + OpenSSL 1.0.2k-fips (CentOS)

    • ⚠ Apache 2.4.6 very old
    • ⚠ OpenSSL 1.0.2 EOL 2019-12-31
    • ⚠ currently 503 maintenance
  • inetdemo.nrl.co.inEOL × 1

    Microsoft IIS 10.0 + ASP.NET 4.0.30319

    • ⚠ IIS 10.0 mainstream EOL 2025-10-14
  • websvc.nrl.co.inEOL × 1

    Microsoft IIS 10.0 + ASP.NET

    • ⚠ IIS 10.0 mainstream EOL 2025-10-14
  • shapp.nrl.co.inEOL × 1

    Apache Tomcat 9.0.70 (AWS ALB-fronted)

    • ⚠ Tomcat 9.0.70 stale (current 9.0.99+)
  • stps.nrl.co.inEOL × 1

    nginx 1.20.1 + Express (Node.js)

    • ⚠ nginx 1.20.1 stale
  • procurixai.nrl.co.in

    nginx 1.30.0 (AWS ALB-fronted, AI tool)

  • vpn.nrl.co.inEOL × 1

    Unknown (likely FortiGate/Citrix/F5/Cisco — not externally fingerprintable)

    • ⚠ VPN appliance brand to be confirmed by CISO
  • www.nrl.co.inEOL × 1

    ASP.NET (X-AspNet-Version: MyServer1 — version obfuscated)

    • ⚠ version obfuscated; CISO confirms internally
  • mgpnrl.nrl.co.inEOL × 1

    ASP.NET (MyServer1 obfuscation, shared IP cluster)

    • ⚠ version obfuscated

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path B: VPN appliance pre-auth RCE

effort hours
detect low (bad)
Entry
Pre-auth RCE on VPN appliance (CVE depends on brand: F5 CVE-2025-53521, Citrix CVE-2025-7775/5777, Fortinet CVE-2023-27997)
Pivot
Session-token theft, MFA bypass via memory leak (CitrixBleed-class)
Objective
Authenticated VPN session as legitimate-looking user; internal network access
#2

Path A: hmis triple-EOL exploitation

effort hours
detect medium
Entry
Any unpatched PHP 7.4 / OpenSSL 1.0.2 / Apache 2.4.6 CVE since 2022
Pivot
Web shell deployment, lateral movement via stolen credentials
Objective
Foothold in NRL corporate estate via the HMIS host
#2

Path E: AI surface prompt-injection / vector-store exfil

effort hours
detect low (bad)
Entry
Malicious document submitted to RAG knowledge base, or prompt injection via user channel
Pivot
Extract API keys via LLM-mediated channel; manipulate model output trusted by automation
Objective
Data exfiltration or trust manipulation in NRL's AI tooling
#3

Path C: Policy-document lure to executive mailbox

effort days
detect medium
Entry
SideCopy-style HPCL/OISD/MoPNG-themed phishing email
Pivot
CurlBack/Spark/Xeno RAT installation, credential theft
Objective
Corporate VPN access via legitimate user session
#4

Path D: IIS/ASP.NET fingerprint to RCE

effort days
detect high (good)
Entry
HTTP.sys or IIS-specific CVE on inetdemo or websvc (CVE-2023-36434)
Pivot
SYSTEM-level access on Windows IIS host
Objective
Foothold in Windows estate

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path B · VPN appliance pre-auth RCE
factor 3-5x
pre-AI
days (CVE-to-exploit chaining)
Mythos
hours
Path A · hmis triple-EOL exploitation
factor 3-5x
pre-AI
days (CVE enumeration + chain)
Mythos
hours
Path E · AI surface prompt-injection / vector-store exfil
factor 50x+
pre-AI
weeks (novel technique)
Mythos
hours
Path C · Policy-document lure to executive mailbox
factor modest
pre-AI
days (lure crafting)
Mythos
days (delivery still human-paced)
Path D · IIS/ASP.NET fingerprint to RCE
factor modest
pre-AI
days
Mythos
days (CVE conditions narrow)

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    hmis.nrl.co.in triple-EOL stack migration

    Host
    hmis.nrl.co.in
    Fix
    Migrate to RHEL 9 / Ubuntu 24.04 LTS (Apache 2.4.62+, PHP 8.x, OpenSSL 3.x). Interim: IP-allowlist via firewall.
    Owner
    Head, IT
    Validation
    curl -sI https://hmis.nrl.co.in | grep -iE 'server|x-powered-by' shows Apache 2.4.62+ and PHP 8.x
  • critical

    nrlportal.nrl.co.in stack upgrade during 503 window

    Host
    nrlportal.nrl.co.in
    Fix
    Same as hmis. Currently in 503 maintenance — opportune upgrade window.
    Owner
    Head, IT
    Validation
    curl -sI https://nrlportal.nrl.co.in returns HTTP/2 200 with Apache 2.4.62+ and OpenSSL 3.x
  • critical

    VPN appliance brand confirmation + KEV patch

    Host
    vpn.nrl.co.in
    CVE
    CVE-2025-53521 / CVE-2025-7775 / CVE-2025-5777 / CVE-2023-27997 (depends on brand)
    Fix
    CISO confirms appliance brand internally. Apply current vendor patch for that brand. Enforce session-token rotation post-patch.
    Owner
    Head, IT (perimeter)
    Validation
    Vendor command (e.g. 'get system status' on FortiGate) shows firmware at or above patched version
  • critical

    IIS 10.0 monthly SU + version-leak suppression

    Host
    inetdemo, websvc
    CVE
    CVE-2023-36434 (HTTP/2 Rapid Reset)
    Fix
    Apply current Windows monthly cumulative update. Strip Server and X-AspNet-Version headers via URL Rewrite.
    Owner
    Head, IT (Windows platform)
    Validation
    curl -sI shows headers absent or generic

Tier 2 · within 30 days

  • high

    ASP.NET MyServer1 cluster version audit + header strip

    Host
    mgpnrl, mgptest, mgpext, portal2, www.nrl.co.in
    Fix
    CISO confirms ASP.NET runtime version internally. Set httpRuntime enableVersionHeader=false in Web.config.
    Owner
    Head, IT
    Validation
    curl -sI shows no X-AspNet-Version header
  • high

    Apache Tomcat 9.0.70 → 9.0.99+

    Host
    shapp.nrl.co.in
    CVE
    CVE-2024-50379, CVE-2024-21733, CVE-2023-46589
    Fix
    Standard Tomcat upgrade: download 9.0.99, swap bin/lib, retain conf/webapps, restart.
    Owner
    Head, IT (Java platform)
    Validation
    curl -sI https://shapp.nrl.co.in | grep -i server shows Tomcat 9.0.99+
  • high

    nginx 1.20.1 → 1.26.x or 1.28.x stable

    Host
    stps.nrl.co.in
    CVE
    CVE-2024-7347 (mp4 module)
    Fix
    OS-distribution package upgrade.
    Owner
    Head, IT (Linux platform)
    Validation
    curl -sI https://stps.nrl.co.in | grep -i server shows nginx 1.26+
  • high

    procurixai AI surface threat-model audit

    Host
    procurixai.nrl.co.in
    Fix
    WAF + rate-limiting + API key audit + SSO with conditional access + full request/response logging.
    Owner
    Head, IT + application owner
    Validation
    WAF rules in place; audit log of last 30 days; SSO confirmed

Tier 3 · within 90 days

  • medium

    Publish /.well-known/security.txt

    Host
    all NRL domains
    Fix
    Static file at /.well-known/security.txt with Contact/Expires/Encryption/Acknowledgments per RFC 9116.
    Owner
    Head, IT (corporate website)
    Validation
    curl -s https://www.nrl.co.in/.well-known/security.txt returns content
  • medium

    Forward-only certificate-transparency policy

    Host
    future internal services
    Fix
    New internal-only services use private CA (AD CS / Vault PKI). External services use wildcard certs at apex.
    Owner
    Head, IT (PKI)
    Validation
    New internal service certificates after policy adoption do not appear in crt.sh queries
  • medium

    DMARC tighten to p=reject

    Host
    nrl.co.in
    Fix
    30-day report monitoring; verify mailersend.net include; update DMARC TXT to p=reject.
    Owner
    IT (email)
    Validation
    dig +short TXT _dmarc.nrl.co.in returns p=reject
  • medium

    Internal-IP cluster network audit

    Host
    125.19.23.188 cluster, 59.144.123.x cluster
    Fix
    For internal-only services: remove public DNS records (split-horizon DNS). For internet-exposed but firewall-blocked: document the rule.
    Owner
    Head, IT (network)
    Validation
    Internal subdomains no longer appear in external DNS
  • medium

    RAG governance audit (open-web-ui.nrlrag)

    Host
    open-web-ui.nrlrag.nrl.co.in
    Fix
    Document RAG sources, audit API key handling, enforce SSO, conversation logging to SOC, output-trust validation.
    Owner
    Head, IT (app platform) + CISO
    Validation
    Governance review document on file; SSO enforced; logs in SOC tooling

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.