SIH26163/Smart Automation

World Monitor security assessment report

A web and mobile security assessment report that lets security analysts evaluate the World Monitor application for vulnerabilities and recommend fixes.

National Technical Research Organisation (NTRO) · Software

Teams already in: Not read yet
Buildable in 36 hours: LowOur estimate, from their wording
Hard blockers: 1Restricted data
Submissions close: 15 Sept9 days left

Make this one of our two Compare with others

Signing in saves it for your whole team — everyone on your invite link sees the same two entries. Anything you shortlisted while signed out comes with you.

Submit on sih.gov.in Dataset Briefing video

Whether this suits your team

Why this fits you

This organisation declared winners on 13 problem statement(s) in SIH 2025 and on 13 in SIH 2024. It has awarded 4 joint winner(s), so it sometimes splits a prize between two teams.

What argues against it

Potential concern: needs data you may not get.

What you would have to build

Decomposed from what the description asks for. Nothing added.

01
Vulnerability Assessment
Identify and document security flaws across authentication, APIs, and data storage.
02
Proof of Concept
Demonstrate safe exploitation of the discovered vulnerabilities in a controlled environment.
03
Impact Analysis
Assess the potential business impact and assign a severity rating to each vulnerability.
04
Remediation Report
Provide practical mitigation strategies and steps to fix the identified risks.

What they ask for, and what they leave open

Both columns are read off the brief's own wording. Nothing here is inferred from the ministry's name.

They state

The jury will check that you find at least one valid vulnerability with documented evidence, clear risk explanation, and practical mitigation strategies. They will also verify that you followed all testing constraints and legal guidelines.

They never say

Whether the organisers will provide access to the actual World Monitor application or if teams must test a mock application
Specific tools or testing frameworks required

A jury can still ask about these. Decide them deliberately rather than by accident.

What they'll ask you

Generated from the brief's own wording and the competition's published rules — never from a guess about what this ministry prefers.

Whether the organisers will provide access to the actual World Monitor application or if teams must test a mock application?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Specific tools or testing frameworks required?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.

8 more— the ones a panel gets to if there is time

The brief asks for vulnerability assessment. How would you build that?
Decoded from SIH26163 itself — Identify and document security flaws across authentication, APIs, and data storage. The brief asks for it by name.

Before you commit

Each one is quoted from a gap in the brief, not a guess about your team.

Needs data you may not get
The problem requires assessing the World Monitor application, which is a proprietary system that students may not have access to.

The data

What the organisers attached, and what the brief assumes you can get.

Dataset from the organisers: Provided — open it
Does the brief need data?: Yes, and they gave it to you.
Briefing video: Published by the organisers

Also from National Technical Research Organisation (NTRO)

Same organisation, same year. Reading two of theirs tells you more about what they care about than reading one.

Take this to an AI

Pick what you are about to do and copy the prompt. It carries the organisers' own wording, the constraints they never spell out, and an instruction not to invent requirements they never set.

Who has this problem, what already exists, and what you would have to find out.

# Context: India's Smart India Hackathon 2026

I am on a student team entering SIH 2026. Problem statement SIH26163, set by National Technical Research Organisation (NTRO).
Its official title, word for word: "Security Assessment of the World Monitor application"
Theme: Smart Automation. Category: software.

In plain terms: A web and mobile security assessment report that lets security analysts evaluate the World Monitor application for vulnerabilities and recommend fixes.

## The organisers' full description, verbatim

• Background The world Monitor application is a Web/ Mobile platform that provides users with real-time monitoring, analytics, and reporting features. The application handles user authentication, data visualization, API communication, and role-based access controls. As a security analyst, the task is to evaluate the application's security posture and identify vulnerabilities that could compromise the confidentiality, integrity, or availability of the system. • Description Conduct an authorized security assessment of the World Monitor application to: 1. Identify security vulnerabilities in the application. 2. Assess the potential impact of each vulnerability. 3. Demonstrate proof-of-concept exploitation in a controlled environment. 4. Recommend remediation measures to mitigate the identified risks. • Scope The assessment should focus on: • Authentication and session management • Authorization and access control • Input validation and data handling • API security • Client-side security controls • Secure communication mechanisms • Data storage and privacy protections • Success Criteria The assessment is considered successful if: • At least one valid vulnerability is identified and documented. • Evidence supports the existence of the vulnerability. • Risk and impact are clearly explained. • Practical mitigation strategies are provided • Expected Solution/Deliverables: For each vulnerability discovered, provide: • Vulnerability title • Description • Affected component • Severity rating (e.g., CVSS) • Steps to reproduce • Proof of concept demonstrating the issue in a safe testing environment • Business impact assessment • Remediation recommendations constraints • Testing must be performed only on authorized systems. • No actions should affect production users or data. • Exploitation should be limited to proof-of-concept validation. • Compliance with applicable laws, policies, and ethical hacking guidelines is required.

## What the brief never says

- Whether the organisers will provide access to the actual World Monitor application or if teams must test a mock application
- Specific tools or testing frameworks required
## Constraints that are not negotiable

- The judged build is a prototype demonstrated in roughly 36 hours by students, not a product.
- A jury evaluates it against this problem statement's own wording, not against general merit.
- We submit on sih.gov.in; the problem statement number and title above must match exactly.
- Your solution must not have appeared in any previous event or programme, of any sort.
- The organisers attached a dataset, so build against theirs rather than inventing one.
- Known obstacles in the brief: Restricted data.

## What I want from you

1. Who actually has this problem in India, and what they do about it today.
2. What already exists — government systems, open-source projects, published research — that we should not rebuild.
3. For each item under 'what the brief never says', what the realistic answer is likely to be and how I could verify it.
4. The two or three things about this domain that a student team would get wrong without local knowledge.
## How to answer

- Everything above between quotation marks is the organisers' own wording. Treat it as the requirement.
- Do NOT invent requirements the brief does not state. If something matters and is not stated, say so and ask me, rather than assuming.
- Where you are inferring rather than reading, mark it as your inference.
- Do not guess what this ministry wants from its name. Its wording above is the only evidence.

---
Problem statement facts assembled by Wynit from National Technical Research Organisation (NTRO)'s published brief for SIH 2026.
The plain-English summary, the list of parts and the evaluator read are our interpretation of that text; the quoted title and the full description are theirs.

The government's original description (269 words)

• Background The world Monitor application is a Web/ Mobile platform that provides users with real-time monitoring, analytics, and reporting features. The application handles user authentication, data visualization, API communication, and role-based access controls. As a security analyst, the task is to evaluate the application's security posture and identify vulnerabilities that could compromise the confidentiality, integrity, or availability of the system. • Description Conduct an authorized security assessment of the World Monitor application to: 1. Identify security vulnerabilities in the application. 2. Assess the potential impact of each vulnerability. 3. Demonstrate proof-of-concept exploitation in a controlled environment. 4. Recommend remediation measures to mitigate the identified risks. • Scope The assessment should focus on: • Authentication and session management • Authorization and access control • Input validation and data handling • API security • Client-side security controls • Secure communication mechanisms • Data storage and privacy protections • Success Criteria The assessment is considered successful if: • At least one valid vulnerability is identified and documented. • Evidence supports the existence of the vulnerability. • Risk and impact are clearly explained. • Practical mitigation strategies are provided • Expected Solution/Deliverables: For each vulnerability discovered, provide: • Vulnerability title • Description • Affected component • Severity rating (e.g., CVSS) • Steps to reproduce • Proof of concept demonstrating the issue in a safe testing environment • Business impact assessment • Remediation recommendations constraints • Testing must be performed only on authorized systems. • No actions should affect production users or data. • Exploitation should be limited to proof-of-concept validation. • Compliance with applicable laws, policies, and ethical hacking guidelines is required.