Technical Annexure

segrgokul (Gokul — QA Engineer, Hyderabad)

viswanthp (Viswanth — Developer)

sarthak-sidhant (Sarthak Sidhant — independent researcher)

package osmWebElement;

import org.openqa.selenium.*;
import org.openqa.selenium.support.*;

public class osm_LoginPageXpaths {

    // OTP field: a plain text input rendered client-side
    @FindBy(xpath = "//div/input[@class='form-input otp-input "
            + "ng-untouched ng-pristine ng-valid']")
    public WebElement otpShown;

    // Login button
    @FindBy(xpath = "//button[contains(text(),'Login')]")
    public WebElement loginBtn;

    // Send OTP button
    @FindBy(xpath = "//button[contains(text(),'Send OTP')]")
    public WebElement sendOTP;

    // Credential fields
    @FindBy(xpath = "//input[@formcontrolname='userName']")
    public WebElement userName;

    @FindBy(xpath = "//input[@formcontrolname='password']")
    public WebElement password;

    @FindBy(xpath = "//input[@formcontrolname='schoolNo']")
    public WebElement schoolNo;

    @FindBy(xpath = "//input[@formcontrolname='dob']")
    public WebElement dob;
}

public String urlBasedLogin(String loginName) {
    String url = "";
    switch (loginName) {
        case "osm":
            url = "https://cbse.onmark.co.in/cbseevalweb/";
            break;
        case "sctevt_live_result":
            url = "https://sctevtexams.in/sn20Yz";
            break;
        case "knr_live":
            url = "https://knruhs.uonex.in/";
            break;
        // ... additional board URLs ...
        default:
            url = "https://cbse.onmark.co.in/cbseevalweb/";
    }
    return url;
}

# Switch target board with one config value
# login_name=osm                  → CBSE
# login_name=sctevt_live_result    → SCTEVT Odisha
# login_name=knr_live             → KNR
login_name=osm

# Credential patterns (values redacted)
osm_username=*****
osm_password=*****

# Service URLs
osm_url=https://cbse.onmark.co.in/cbseevalweb/

package osm_runner_Exceution;

import org.testng.*;
import org.testng.annotations.*;

public class osm_Exceution {

    WebDriver driver;
    List<String> methodsToRun;

    @Parameters({"TestMethod"})
    @BeforeTest
    public void beforeTest(@Optional("") String testMethods) {
        // Jenkins feeds test methods via -DTestMethod parameter
        methodsToRun = Arrays.asList(testMethods.split(","));
    }

    @Test(priority = 1)
    public void loginTest() {
        // Credentials from environment variables or Excel
        String filePath = System.getenv("Filepath");
        String loginName = System.getenv("Project_Login");
        String browser   = System.getenv("Browser");

        osm_Login_Page loginPage = new osm_Login_Page(driver);
        loginPage.login(username, password, schoolNo, dob);
    }

    @Test(priority = 2, dependsOnMethods = "loginTest")
    public void markingTest() {
        osmMainAssessmentPage marking = new osmMainAssessmentPage(driver);
        marking.markAnswerSheets();
        marking.submitEvaluation();
    }
}

Key observation: The runner uses @Parameters and System.getenv() for credential injection — designed for unattended CI execution. A Jenkins job with an Excel sheet of evaluator credentials can sequentially log in, mark, and submit for each account.

Extracted via: grep -oP '"OnMarkWinWebAPI/[^"]*"' bundle.js | sort -u

Authentication

Evaluation — Core

Re-evaluation

Verification

Dashboard & Reporting

Face / Photo

Notifications

Infrastructure

77 total endpoints. Full extraction available in archived bundle at zo.pub.

8a. OCR.space API (Cloud-based)

Source: ocrTextModules/Ocr_Text_Extraction_Using_API_Key.java — used for SCTEVT marksheet text extraction, not CBSE OSM. Shown here because it demonstrates Coempt's broader OCR processing capability.

// From ocrTextModules/Ocr_Text_Extraction_Using_API_Key.java
// Uses cloud OCR.space API with key from config.properties

String url = "https://api.ocr.space/parse/image";
con.setRequestProperty("apikey", apiKey);

String postData =
    "language=eng" +
    "&isOverlayRequired=true" +
    "&isTable=true" +
    "&scale=true" +
    "&detectOrientation=true" +
    "&OCREngine=2";

8b. Google Gemini Vision API — Marksheet Schema Extraction

// From nizamProject/SchemaExtractor.java (commit 392614d, 14 Mar 2026)
// Extracts marking schema from university marksheets using Gemini Vision

String prompt = """
    You are analyzing the FIRST PAGE of a university marksheet PDF.

    Extract the marking schema, subjects, and grade conversion table.

    Return strictly valid JSON:
    {
      "university_name": "",
      "exam_title": "",
      "num_subjects": 0,
      "total_credit": 0,
      "max_marks": 0,
      "min_marks": 0,

      "subjects": [
        {
          "sr": 0,
          "abbr": "",
          "subject_name": "",
          "tu": 0,
          "ti": 0,
          "pu": 0,
          "pi": 0,
          "tumin": 0,
          "pumin": 0,
          "total": 0,
          "min": 0,
          "exmp": 0,
          "credit": 0
        }
      ],

      "theory_grading": [
        {
          "grade": "",
          "description": "",
          "range_min": ,
          "range_max": ,
          "grade_point": 
        }
      ],

      "practical_grading": [
        {
          "grade": "",
          "description": "",
          "range_min": ,
          "range_max": ,
          "grade_point": 
        }
      ]
    }

    Rules:
    - Extract ALL subjects
    - Extract TU, TI, PU, PI marks
    - Extract TUmin and PUmin
    - Extract TOTAL and MIN marks
    - Extract EXMP if present
    - Extract CREDIT
    - If a value is "-" return null
    - Return ONLY JSON
    - GRADING RANGES: Use the exact boundary value (e.g., 90) for
      'range_max' even if the PDF says '< 90'.
    - PRINT THE GRADE VALUE AS IT IS LIKE IF IT HAS 05 IN IT
      PRINT 05 AND IF IT HAS 5.5 PRINT 5.5 DONT ROUND IT UP
    - Return ONLY valid JSON.
    """;

Note: The file was src/main/java/nizamProject/SchemaExtractor.java — first added in commit 392614d. In the current main branch the Gemini prompt still exists but the API key was moved to config.properties. The hardcoded key in the original commit has since been removed from the file on main, but remains accessible in git history. No keys or credentials are disclosed in this post.

8c. Custom PDF Extraction

package rtmnuTRProject;

// Structured extraction from PDF answer sheets
// Used for post-evaluation data processing

This is full server-side code for the AP SBTET instance — included because the shared vendor (Coempt) and identical security patterns are relevant context.

Custom Cryptography — HbCrypt.cs

namespace SBTET.Security {
    public class HbCrypt {
        // Custom hash implementation (not bcrypt despite the name)
        public static string Hash(string input) {
            // Uses SHA1 internally — see SHA1.cs
            return SHA1.Hash(input + salt);
        }
    }
}

SHA1.cs — Weak hashing

namespace SBTET.Security {
    public class SHA1 {
        public static string Hash(string input) {
            // System.Security.Cryptography.SHA1
            // Note: SHA1 is cryptographically broken (2017)
        }
    }
}

Controller surface (14 controllers)

Controllers/
├── AccountController.cs          # Login, Register, ForgotPassword
├── AdminPanelController.cs       # Admin operations
├── HomeController.cs              # Dashboard, Index
├── StudentPanelController.cs      # Student-facing pages
├── PreExaminationController.cs    # Pre-exam management
├── PostExaminationController.cs   # Post-exam, results
├── NotificationController.cs      # Notification CRUD
├── MasterController.cs            # Master data management
├── BillDeskPaymentController.cs   # BillDesk payment gateway
├── PaymentController.cs           # Payment processing
├── HomeController.cs              # PDF report generation
├── ExcelController.cs             # Excel import/export
└── ApiController.cs                # REST API endpoints

Web.config — Connection strings (RELEASE transform)

<!-- From Web.Release.config (production transform) -->
<connectionStrings>
  <add name="SBTETEntities"
       connectionString="metadata=res://*/Model.SBTETModel.csdl|...;
         provider connection string="
           data source=PRODUCTION_DB_SERVER;
           initial catalog=SBTET_DB;
         user id=PRODUCTION_DB_USER;
         password=PRODUCTION_DB_PASSWORD;""
       providerName="System.Data.EntityClient" />
</connectionStrings>

Note: The actual connection string values are in the repository. We verified their presence but are not reproducing them.

Critical window: CBSE Class 12 exams ran 15 Feb – 4 Mar 2026. Mock eval circular: 25 Feb. The portal rewrite (24 Feb) happened before the mock circular and during the exam window.

Original Repos (still live on GitHub as of 29 May 2026)