MEDIUM · regulator

Petroleum and Natural Gas Regulatory Board

2026-10-06 passive check: HTTP 200; TLS expires 2026-12-07; 1 headers absent on observed response.

pngrb.gov.inbaseline scan 2026-04-27 · daily passive check 2026-10-06 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-06

score 4

Availability

HTTP 200

TLS

2026-12-07 · 62d

Headers

1 missing · 0 permissive

Email auth

SPF soft · DMARC quarantine

64

Baseline score · 2026-04-27

Watch

Historical findings · 2026-04-27

  • 01edev.pngrb.gov.in subdomain in CT logs — internal/dev environment named publicly
  • 02IIS Server header restricted but ETag visible — partial fingerprint leak
  • 03Soft-fail SPF (~all) allows downgrade attacks
  • 04All 6 hardening headers present

TLS security

pass

Issuer
GlobalSign nv-sa
Expires
2026-12-07(62d)

Email authentication

SPF
soft
DKIM
unknown
DMARC
quarantine

Hardening headers

5 / 0 / 1present/permissive/missing

  • HSTSpresent
  • CSPpresent
  • X-Framepresent
  • X-Content-Typepresent
  • Referrer-Policypresent
  • Permissions-Policymissing

Lookalike domains

  • pngrb.gov.com→ 50.16.218.27 (AWS — typosquat cluster)

Public topology · CT logs

6 total · 1 sensitive

pngrb.gov.in
Dev / Test / UAT
  • edev.pngrb.gov.in

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

Why does PNGRB maintain a publicly DNS-indexed development environment (edev.pngrb.gov.in), and what is the incident response if dev configuration data has been harvested?

Active fingerprints · per host

  • pngrb.gov.inEOL × 1

    Microsoft IIS (Server header restricted) on Windows + likely .NET backend, GlobalSign OV TLS

    • ⚠ IIS version concealed; if Windows Server 2016, mainstream EOL Jan 2022
  • edev.pngrb.gov.inEOL × 1

    Same IIS as parent; explicitly named development environment

    • ⚠ dev subdomain in public CT — should not be externally indexed

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path A: Public edev subdomain → dev-environment configuration leak

effort hours
detect low (bad)
Entry
edev.pngrb.gov.in publicly registered in CT; typical dev exposes /web.config, /debug, test creds, /.env.example.
Pivot
Harvest connection strings, API keys, test admin accounts; pivot from dev to prod via shared credentials.
Objective
Compromise prod via dev path; exfiltrate dev DB which often mirrors prod schema/data.
#2

Path B: IIS ETag fingerprint → version inference → CVE-targeted exploit

effort days
detect medium
Entry
ETag visible in HTTP responses leaks IIS version pattern.
Pivot
Parse ETag → enumerate CVEs (CVE-2023-36434 HTTP/2 Rapid Reset; CVE-2023-21809 HTTP.sys memory corruption).
Objective
RCE; SYSTEM-level access on Windows IIS host.
#2

Path C: Soft-fail SPF + DMARC p=quarantine → email spoofing for regulator impersonation

effort hours
detect low (bad)
Entry
DMARC p=quarantine (not reject); SPF soft-fail.
Pivot
Spoof PNGRB director-level emails to MoPNG/DGH/CMD audiences with urgent regulatory request.
Objective
Credential harvest, policy-decision interference.

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path A · Public edev subdomain → dev-environment configuration leak
factor ~6×
pre-AI
3 hours (edev enumeration + endpoint discovery + config harvest)
Mythos
30 min (subdomain fuzzing, common dev paths, parallel config-file extraction)

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    Remove edev.pngrb.gov.in from public DNS; migrate to internal-only

    Host
    edev.pngrb.gov.in
    Fix
    Delete or NXDOMAIN the edev DNS record. Provision new dev on edev-internal.pngrb.local accessible only via VPN. Revoke public cert. Audit CT for any unauthorised edev certs issued.
    Owner
    Infrastructure / DevOps
    Validation
    nslookup edev.pngrb.gov.in returns NXDOMAIN externally
  • critical

    Upgrade DMARC from p=quarantine to p=reject

    Host
    pngrb.gov.in (email)
    Fix
    Monitor 30 days of rua reports for legitimate-sender failures; then change DMARC TXT to p=reject.
    Owner
    IT / Email Security
    Validation
    dig +short TXT _dmarc.pngrb.gov.in returns p=reject
  • critical

    Confirm Windows + IIS patch level; apply current monthly cumulative updates

    Host
    pngrb.gov.in
    CVE
    CVE-2023-36434, CVE-2023-21809
    Fix
    Get-ItemProperty HKLM:\Software\Microsoft\InetStp for IIS version. wmic qfe list for KB inventory. Apply current Windows monthly cumulative.
    Owner
    Infrastructure / Windows Administration
    Validation
    wmic qfe list shows current month's KB; Microsoft Update history clean

Tier 2 · within 30 days

  • high

    Suppress IIS ETag header or randomise to prevent fingerprinting

    Host
    pngrb.gov.in
    Fix
    web.config customHeaders: <add name='ETag' value='' /> or use opaque ETag pattern.
    Owner
    Infrastructure / IIS Administration
    Validation
    curl -i pngrb.gov.in | grep -i etag returns empty or opaque
  • high

    Audit .NET deserialization usage; replace BinaryFormatter with JSON

    Host
    pngrb.gov.in
    Fix
    grep -r BinaryFormatter | LosFormatter | NetDataContractSerializer in codebase. Migrate to System.Text.Json with strict type binding. ysoserial.net testing.
    Owner
    Backend Engineering
    Validation
    ysoserial.net payloads rejected

Tier 3 · within 90 days

  • medium

    Implement CT monitoring for all PNGRB subdomains

    Host
    *.pngrb.gov.in
    Fix
    CAA records: 'CAA 0 issue "globalsign.com"'. Censys/SSLMate/certspotter monitoring on *.pngrb.gov.in.
    Owner
    Infrastructure / PKI
    Validation
    dig pngrb.gov.in CAA shows GlobalSign restriction; CT monitor active

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.