ODINT Investigation Team2026-04-10
Universities Dump
Ecuador Universities — Reconnaissance Dump
User Enumeration Results
PUCE — Pontificia Universidad Católica del Ecuador (puce.edu.ec)
| ID | Slug | Display Name | Notes |
|---|---|---|---|
| 1 | santiago |
usrAdminPPuce | Primary admin — username reveals admin naming pattern |
| 3 | aeabril |
aeabril | Staff |
| 4 | jasanchez |
jasanchez | Staff |
| 11 | kviera004 |
Kerlly Viera | Numbered suffix suggests multiple accounts |
| 13 | bmsempertegui |
Brenda Sempértegui | Staff |
Universidad de Cuenca (ucuenca.edu.ec)
| ID | Slug | Display Name | Notes |
|---|---|---|---|
| 1 | daniel-urgiles |
daniel.urgiles | Primary admin |
| 6 | jfrancisco |
Francisco | Staff |
| 7 | lourdes |
Lourdes | Staff |
| 8 | googlesheets |
googlesheets | Service account — Google Sheets integration |
| 11 | evelinvaldivieso |
evelinvaldivieso | Staff |
| 13 | silvi |
silvi | Staff |
| 14 | marcelorodriguez |
marcelorodriguez | Staff |
Notable:googlesheets service account indicates automated content pipeline from Google Sheets.
ESPE — Military University (espe.edu.ec)
- WordPress + Elementor + WooCommerce
/wp-json/returns 503 (overloaded or rate-limited)/wp-json/wp/v2/usersreturns 401 (protected — good)- Analytics: GA UA-130554889-1, GA4 G-DNYB2YPXC9, Microsoft Clarity unlxvbr0ec
- Subdomains: admision, investigacion, ugp, uar, cec, ugvc, guia, transparencia
Other Universities
| University | CMS | User Enum | SSL | Notes |
|---|---|---|---|---|
| ESPOL (espol.edu.ec) | Drupal | N/A | OK | GA: UA-5343888-2, G-2QNGYSJLK4 |
| UCE (uce.edu.ec) | Liferay | Auth required | OK | CompanyID: 10154, GroupID: 10181, CDN: aka-cdn.uce.edu.ec |
| EPN (epn.edu.ec) | Unknown | — | BROKEN (can't verify first cert) | — |
| UTA (uta.edu.ec) | Unknown | — | BROKEN (can't verify first cert) | — |
| UEES (uees.edu.ec) | Unknown | — | BROKEN (can't verify first cert) | — |
| UNL (unl.edu.ec) | Non-WordPress | 404 | OK | Not WordPress-based |
| UTPL (utpl.edu.ec) | SPA (React/Vue) | N/A | OK | GTM: GTM-WNSBR2RP |
Summary
Method: WordPress REST API, homepage analysis
- 12 university staff/admin accounts exposed across PUCE and UCuenca
- 3 universities have broken SSL certificates (EPN, UTA, UEES)
- ESPE (military university) properly blocks user enumeration
- UCE runs Liferay (same as SRI tax authority) with JSONWS requiring auth
- ESPOL runs Drupal — best security posture among universities
- Service account
googlesheetson UCuenca reveals automated integration
END OF RECORD
Continue exploring