Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Also later I figured out that there was no sanitation in the php script, so I could enter HTML into the "leave reason" text box input and have it show up as a part of the page in the "leave status check" page.
I submitted image tags in the"reason" field pointing to softcore p0rn. When students logged into the portal to check their bogus leaves, they were greated with...heh. -
Best I ever did was a DDO on the university network using their own machines. It was by accident but they never figured it out somehow. When I did I had the best laugh of my life. The next year they had limited outgoing connections. It was not stopping the attack anyway but at least they were trying.
-
@Pickman Reminds me of a student project on distributed computation, where we had to build distributed system for high volumetry.
As an example application, the teacher proposed to scrap the college website pages to collect lots data and apply some random process on it.
Can you guess what happens when a whole group of students create distributed application to scrap a website designed for minor use. Dozen of times to solves their bugs and sometime without knowing what they are doing with their scraper?
The whole network was down with some daemons lost on every workstations, unreachable but still dooming the network trying to scrap the website.
!Rant
I GRADUATED FROM COLLEGE TODAY WITH MY DEGREE IN COMPUTER SCIENCE!
Now to find a job :D
So this story is from my University days. I was in the 6th semester back then, studying CS.
My University website was pretty shitty. Basically it was one of those old ass website that said "Best viewed in IE8". Anyway, I was snooping about the website, trying to find some news regarding an event.
I logged into my account, and randomly browsed into the leave request portal. This was a basic HTML form where students could apply for leaves from the classes and see the status of the leaves, if they have been granted or not. I noticed that the link to the request portal from the student login welcome page was actually something like http://univ.com/student/index.php/..., here 1234567 was my student ID. Yep, it was hardcore into the page, and sent as a GET request on being clicked. That was their idea of authentication I guess. I change the student ID to someone else's, and it let me login as that person.
Long story short, I wrote a little python script to login as every person from the starting of student IDs, till the end, then submit a leave request with a random dumb reason like "can't come, at the strip club" or "going for sex change operation". What I did not know was that when a request is submitted, a text message is also sent to the student's guardians phone number. I ran the script.
That day, over 1000 parents received text messages from the University saying that their kids have applied for a leave from random date to random date for some retarded reason. It was a blast. Students were talking about how someone had "Hacked" into the system.
devrant
exploit
authentication
university