Quick Answer: The NIT Srinagar bug hunt ran from October 25 to 30, 2026, as a five-day Cybersecurity Awareness and Bug Hunt. The Bureau of Indian Standards (BIS) Student Chapter of the Computer Science and Engineering and Information Technology departments organised it. Team 404 Found won first prize of ₹10,000 for finding digital security vulnerabilities. The programme stressed ethical hacking and responsible reporting.
Most campus tech events end with a trophy photo and a press release. The NIT Srinagar bug hunt was different in one way that matters: students were rewarded for finding weaknesses in digital systems and for reporting them responsibly. That combination is what separates a useful security exercise from a risky one. Here's what happened, what the results tell you, and what other students can take from it.
What Happened During the Five-Day Programme
As Kashmir Reader reported, the event ran from October 25 to 30 at the National Institute of Technology (NIT) Srinagar. It combined three things:
- Expert interactions with the institute's security leadership
- Awareness sessions on safe online practices
- A hands-on bug hunt competition, plus cybersecurity quizzes
Director Prof. Anurag Misra urged students to build technical depth in security. Ms. Jyoti Kushwaha, Scientist-D and Joint Director in the Electronics and IT Department at BIS, attended as Chief Guest and stressed digital awareness and vigilance against emerging threats. The initiative was guided by Dr. Ahsan Chishti, the institute's Chief Information Security Officer, along with Dr. Iqra Altaf Gillani and Dr. Sparsh Sharma. Disha Mehra, a fourth-year CSE student, led it.
That mix matters. Awareness sessions alone teach people what phishing looks like. A live bug hunt forces them to think like an attacker, then like an engineer who has to fix the problem.
The Results, and What the Prize Structure Signals
The prize list is worth reading closely because it shows what the organisers valued:
- Team 404 Found (Piyush Dhakad, Vansh Saini, Prince, B.Tech): ₹10,000
- Team Pasikdar (Younis Ayoub Parray, Malik Tafheem, Iram Naseer, M.Tech): ₹7,500
- Karuturi Gowri Shankar: ₹5,000
Pranjul Khankriyal, Veer Rastogi and Mohsin Wani received consolation prizes. Team CodeSaga (Ritik Bhardwaj, Mohammed Anas, Dashmesh Deep Singh) received special recognition for identifying and reporting a security vulnerability.
Notice that CodeSaga's recognition was for the reporting as much as the finding. The source doesn't say how many bugs each team found, and that's the point. The organisers signalled that a real, properly communicated vulnerability carries weight on its own. Here's where most people miss the lesson: in a real engagement, a finding that isn't reported clearly is worth close to nothing.
Why Responsible Reporting Matters More Than the Find
This is the part most coverage skips, and it's the part that protects people.
Under the international standard ISO/IEC 29147, which covers vulnerability disclosure, a finder reports a flaw privately to the vendor or system owner. The owner then triages it, develops a fix, and coordinates a public advisory. ISO/IEC 30111 covers the handling side: how the organisation receives, prioritises and resolves those reports.
Coordinated vulnerability disclosure exists because of a simple cause-and-effect chain. When a researcher posts a working exploit publicly before a patch exists, attackers get a head start, and every unpatched system becomes a target. The researcher hasn't made the system safer. They've only made the attack easier.
Here's the counter-intuitive part. Many students assume the "best" hacker is the one who finds the most dramatic bug and publishes it fastest. In practice, the professionals who get hired back are the ones whose reports are reproducible, scoped, and calm about severity. A short report with clear steps, impact and a suggested fix is worth more than a long dump of scanner output.
Campus Bug Hunts vs. Bug Bounties vs. Disclosure Policies
Students often mix up three different models. This table shows how they differ.
| Model | Typical duration | Who runs it | How finders are paid | Main risk to watch |
|---|---|---|---|---|
| Campus bug hunt (like NIT Srinagar's) | Days to a few weeks | College chapter or faculty team | Fixed prize pool; top prize here was ₹10,000 | Narrow scope; teaches method more than volume |
| Public bug bounty program | Ongoing | Company or platform operator | Per validated finding, amounts vary by severity | Unclear scope can turn testing into unauthorised access |
| Coordinated disclosure policy | Permanent | Any organisation publishing a contact | Usually unpaid; recognition or acknowledgement | Finder must follow the process, even when the vendor is slow |
For a student, the campus hunt is the safest starting point. The scope is defined, the organisers are reachable, and mistakes are easy to recover from. Public bounty programs pay more but demand more discipline. Most publish their rules at a location defined by RFC 9116, the security.txt standard, which tells you where to send reports.
The Misconception: More Bugs Means a Better Hunter
Here's where most guides go wrong: they treat vulnerability hunting like a numbers game. It isn't. Scanner findings are noisy, and many are false positives or low-impact issues that a maintainer will close in minutes.
The skill that gets respect is validation. Can you reproduce the issue on a clean setup? Can you explain its impact in one sentence? Can you say what the fix should look like? Those are the questions a triager asks first, and a clear answer usually beats a dramatic one.
That said, there's a real catch. Testing a system without written permission is a legal problem, not just a professional one. Under India's Information Technology Act, 2000, unauthorised access and damage to computer systems fall under sections 43 and 66. Good intentions don't remove that exposure. If your target isn't clearly in scope, stop and ask.
How Students Can Start Ethical Hacking Safely
If you're asking how to start, the answer is to build fundamentals before you touch anything real. This is the sequence most working security engineers recommend:
- Learn how the web works. HTTP requests, cookies, sessions and authentication are where most beginner findings live.
- Study the OWASP Top 10. The Open Worldwide Application Security Project's list of common web risks gives you a shared vocabulary with every security team you'll meet.
- Practise on legal targets. Deliberately vulnerable apps such as OWASP Juice Shop, plus platforms like TryHackMe and Hack The Box, let you break things without legal risk.
- Learn the core tools. Burp Suite Community Edition lets you inspect and modify web traffic. OWASP ZAP does similar work for free. Nmap maps open ports on systems you're authorised to scan.
- Write every finding up as a report. Describe the steps, the impact, and the fix. Practise this more than you practise exploitation.
Notice what this sequence leaves out: any step that starts with a live target you don't own. That's intentional. Skipping straight to live targets is the most common way well-meaning students end up in trouble.
Frequently Asked Questions
What was the NIT Srinagar bug hunt?
The NIT Srinagar bug hunt was a five-day Cybersecurity Awareness and Bug Hunt 2026, held from October 25 to 30. It was organised by the BIS Student Chapter of the CSE and IT departments. Students competed to identify digital security vulnerabilities, and Team 404 Found won first prize of ₹10,000.
How can students start ethical hacking safely?
Start with web fundamentals and the OWASP Top 10, then practise on deliberately vulnerable apps like OWASP Juice Shop. Only test systems you're authorised to test, ideally those with a published scope or written permission. Write every finding up as a short report with steps, impact and a suggested fix.
Why does responsible vulnerability reporting matter?
Responsible reporting gives the system owner time to fix a flaw before attackers exploit it. Standards such as ISO/IEC 29147 describe private reporting followed by coordinated disclosure. Publishing an exploit early removes that window and puts every unpatched system at risk.
Is it legal to test websites for bugs in India?
Only with clear authorisation. Under the Information Technology Act, 2000, unauthorised access to or damage of computer systems can attract penalties under sections 43 and 66. If a target has no published scope or permission, don't test it. Ask the organisation first, or consult a lawyer if you're unsure.
Take the Lesson From the NIT Srinagar Bug Hunt
The NIT Srinagar bug hunt shows what a well-run student security event looks like: a defined scope, expert mentors, and rewards for responsible reporting as well as for technical skill. The most useful takeaway is that a vulnerability is only valuable once someone can fix it. Try one legal practice lab this week, write up a single finding as if you were sending it to a real vendor, and notice how much harder the report is than the exploit. Pass this to a classmate who's been wrestling with how to start ethical hacking without crossing a legal line.