================================================================ MEXICO CTF / BUG BOUNTY — ALL RECOVERED CREDENTIALS Campaign: Mexican .git Exposure + Open API Recon Updated: 2026-02-25 ================================================================ === uaem.mx (Universidad Autonoma del Estado de Morelos) === MySQL: facdisenousr : LXN*j@9nmVmN @ www.uaem.mx / consfacdiseno SMTP #1: constancias.facdisenio@uaem.mx : Cons_facDisenio9102 @ smtp.gmail.com:465 SMTP #2: constancias.fcqei@uaem.mx : Ventanill4FCQ31 @ smtp.gmail.com:465 === ieeq.mx (Instituto Electoral del Estado de Queretaro) === PgSQL (prod): postgres : Eqaeccasm1500V+- @ 127.0.0.1 / ieeq_site, ieeq_site_admin PgSQL (dev): postgres : root @ localhost / db_Sergio, db_Web, db_Pagina MySQL (Azure):web : fb&BN3cse8j_MH5v @ 104.45.237.221 / ieeq_ieeqmx9453639538, cartografia_ieeqmx3692896128 MySQL (Comms):CCS : C0munic4ci0n.S0ci4l @ 187.191.76.50 / ieeq === ss.puebla.gob.mx (Secretaria de Salud de Puebla) === MySQL: dst_ss : m%e7A_fAMpt9dVbZ @ localhost / dst_ss (prefix: q4gqt_) Joomla Secret: xSGvpdh2s4Oo1c4F Mail From: portalpuebla@gmail.com === elsiglodetorreon.com.mx (El Siglo de Torreon Newspaper) === MySQL (rw): centenariorw : wwZtK7@c1en1 @ localhost / siglo90, durango MySQL (s22): eT9Server3 : vwDvhNXckAntcWjB6E @ s22 / siglo90 MySQL (s1): eT9Server3 : vwDvhNXckAntcWjB6E @ s1 / Tienda MySQL (IBM): centenario : wwZgtK7@c1en @ 52.117.172.166 / siglo90 MySQL (boa): centenarioboa : vchtBfOfVaYhyBe@100 @ localhost / siglo90, durango MySQL (club): centenario : wwZgtK7@c1en @ localhost / siglo90 MySQL (autos):autos : f0$f0r0Qui3roCaf3 @ 127.0.0.1 / autos MySQL (arch): archive : camaraf0f0r0@ @ localhost / archive SMTP: ventas@losclasificados.mx : mel588mo @ correo.elsiglo.mx:587 Tokens: TOKEN_PASSWORD: k@VDKgrKRI!z5YVZ76PJpjwB4#rEs0FswcYaGOGmS2HhT8@ce! TOKEN_TARJETA: 3ls1glo100|2021-12-07 TOKEN_PASS: enb5SWeXtgQmFjdr9wBecnFVjx4QrwMq3zFKPYhvFZ6QXJR7HMZPNREEd4me3kK2tVHcNFUjXJfBuJafYmz7X2H8cZQRkPW4 AdSense: ca-pub-5687735147948295 / slot 9692393977 === repodatos.atdt.gob.mx (Federal Open Data API - ATDT) === NO AUTH REQUIRED - EVERYTHING IS OPEN Root URL: https://repodatos.atdt.gob.mx/ Data: 64 GB full mirror (50.12 GB enumerated + s_* mirrors) Files: 1,084+ across 38 all_data agencies, 11 s_* dirs, 177 api_update agencies Records: 186,000,000+ estimated Dump: COMPLETE - mirrored 2026-02-25 Full URLs to PII datasets: Birth Records (SINAC) ~60M records, 12.3 GB: https://repodatos.atdt.gob.mx/all_data/secretaria_salud/77c166cc-bcbf-4b28-806e-f2a60c3de821/ Death Records ~25M records, 6.1 GB: https://repodatos.atdt.gob.mx/all_data/secretaria_salud/6fecbbb3-afd9-44a1-8665-679a80ce4a15/ Education Centers (CURP/RFC/names/phone) ~6M records, 1.7 GB: https://repodatos.atdt.gob.mx/all_data/secretaria_educacion/2a1d047c-546b-4293-971a-c835689a37a5/ Migration Tramites ~1.3M records, 257 MB: https://repodatos.atdt.gob.mx/INM/regulacion_migratoria/Tramites_Migratorios.csv https://repodatos.atdt.gob.mx/INM/regulacion_migratoria/Documentos_Migratorios.csv Irregular Migration Events ~700K records, 175 MB: https://repodatos.atdt.gob.mx/all_data/secretaria_gobernacion/eventos_migratoria_irregular_2023/situ_irregular_2023.csv Crime Incidence ~2M records, 424 MB: https://repodatos.atdt.gob.mx/SESNSP/incidencia_delictiva/IDM_NM_ene25.csv https://repodatos.atdt.gob.mx/SESNSP/incidencia_delictiva/INM_estatal_ene.csv Procurement ~4.5M contracts, 907 MB: https://repodatos.atdt.gob.mx/compranet_historico.csv HIV/AIDS Treatment ~100K records, 22 MB: https://repodatos.atdt.gob.mx/CENSIDA/activas_con_tratamiento/Personas_Tratamiento_Antirretroviral_julio_2023_diciembre_2024.csv https://repodatos.atdt.gob.mx/CENSIDA/activas_con_tratamiento/Personas_Tratamiento_Antirretroviral_junio_2022_junio_2023.csv Gas Prices ~85M records, 1.3 GB: https://repodatos.atdt.gob.mx/CRE/precios_gas_lp/Historico_Precios_Expendios.csv_2024.csv https://repodatos.atdt.gob.mx/CRE/precios_gas_lp/Historico_Precios_Expendios.csv_2023.csv 177 Agency API Directory: https://repodatos.atdt.gob.mx/api_update/ IMSS CNDH Complaints: https://repodatos.atdt.gob.mx/IMSS/recomendaciones_cndh/RecCNDH-2024-4Trim.csv Forest Fire Data: https://repodatos.atdt.gob.mx/CONAFOR/incendios_forestales/ Population Projections (CONAPO) ~202 MB: https://repodatos.atdt.gob.mx/CONAPO/proyecciones/ https://repodatos.atdt.gob.mx/CONAPO/indices_marginacion/ https://repodatos.atdt.gob.mx/CONAPO/accesibilidad_c_urbanos/ Poverty & Social Lag (CONEVAL) ~48 MB: https://repodatos.atdt.gob.mx/CONEVAL/pobreza/ https://repodatos.atdt.gob.mx/CONEVAL/rezago_social/ Treasury/Hacienda ~461 MB: https://repodatos.atdt.gob.mx/s_hacienda_cred_publico/ Agriculture ~403 MB: https://repodatos.atdt.gob.mx/s_agricultura_des_rural/ Health Sub-datasets (s_salud) ~16 GB: https://repodatos.atdt.gob.mx/s_salud/nacimientos/ https://repodatos.atdt.gob.mx/s_salud/defunciones/ https://repodatos.atdt.gob.mx/s_salud/enf_cronicas_adultos/ https://repodatos.atdt.gob.mx/s_salud/planif_fam_metodos_entreg/ https://repodatos.atdt.gob.mx/s_salud/planif_fam_usuarios/ https://repodatos.atdt.gob.mx/s_salud/consultas_m_embarazadas/ https://repodatos.atdt.gob.mx/s_salud/control_nutricion_inf/ https://repodatos.atdt.gob.mx/s_salud/aplicacion_vacunas/ === api.elsiglodetorreon.com.mx (Exposed .git - Partial) === Git remote: git@github.com:MrBoa-s-Company/api-app-tor.git Upstream: rcasanovae/api-app-tor Status: .git/config exposed, full dump blocked ================================================================ CONNECTABLE EXTERNAL IPs ================================================================ 104.45.237.221 ieeq.mx MySQL Azure 187.191.76.50 ieeq.mx MySQL Comunicacion Social 52.117.172.166 elsiglodetorreon IBM Cloud MySQL ================================================================ GIT REPOS DISCOVERED ================================================================ github.com:norgoth/uaem2023.git (uaem.mx) gitlab.com:dianguemoli/ieeq.git (ieeq.mx) git.develop.dst:dds/secretaria-de-salud.git (ss.puebla.gob.mx internal) github.com:es-trc/centenario.git (elsiglodetorreon.com.mx) github.com:MrBoa-s-Company/api-app-tor.git (api.elsiglodetorreon.com.mx) bitbucket.org:mvsradio/grupo_mvs_v2_landing.git (mvs.com) 10.1.4.194:8085/Alejandro.paredes/mw-red-de-sitios.git (fiscalia.durango.gob.mx internal) ================================================================ DEVELOPER IDENTITIES (37+) ================================================================ uaem.mx: Rafael Fragoso (norgoth/GGakko) rafael.fragoso@uaem.mx Amy Malavar amymalavar@gmail.com Carlos Clemente carlos.clemente@uaem.mx Jelsy Uribe jelsy.uribe@uaem.mx Multimedia (team) multimedia@uaem.mx Roxandesanz sanchezrandrade@gmail.com Victor Gonzalez zarinana.gonzalez@gmail.com Ricardo Morales armoralesricardo@gmail.com Alan Martinez norgothmx@gmail.com ieeq.mx: Diana Guerra (dianguemoli07) diana.guerra@ieeq.mx Melchor Leal melchor.leal@ieeq.mx JORGE LARA MENDOZA jorge.lara@ieeq.mx Sergio I. Gutierrez Q. sergio.gutierrez@ieeq.mx Jorge jorge.mendoza@skyflop.xyz ss.puebla.gob.mx: Rene Limon renecomes@gmail.com elsiglodetorreon.com.mx: @MrBoa / Eugenio Ramirez Casanova rcasanovae@gmail.com Carlos Rodriguez carlosrdz_16@hotmail.com Gustavo Ronaldo Hernandez hernandezgustavoronaldo@gmail.com Jaime Favela jfavela@elsiglo.mx Jorge Martinez Mauricio jorgem@gmail.com Jorge Avila Flores jorge.aviflores@gmail.com Marco Huitron marcohuitron@outlook.com es-trc (org) apps@elsiglo.mx ziscko ziscko.team@gmail.com mvs.com: Alfredo Gonzalez (agonzalez_) agonzalez@mvs.com fiscalia.durango.gob.mx: Alejandro Paredes (internal Gitea) ================================================================ TOTALS ================================================================ Credential sets: 17 Application tokens: 4 Joomla secrets: 1 Open APIs (no auth): 1 (64 GB mirror, 186M+ records) Developer identities: 37+ Git repos discovered: 7 External IPs: 3 Federal agencies exposed: 177