120 likes | 269 Views
ECollege Hacking. Marcial White. Introduction. Client Side vs. Server Side Javascript POST vs. GET. Howto Retake tests. Using simple URL manipulation …. That’s pretty much it. Examine the source code Rebuild the URL with the pertinent variables Hit enter.
E N D
ECollege Hacking Marcial White
Introduction • Client Side vs. Server Side • Javascript • POST vs. GET
Howto Retake tests • Using simple URL manipulation …. That’s pretty much it. • Examine the source code • Rebuild the URL with the pertinent variables • Hit enter
Look for this chunk of Javascript • <!-- function BeginExam() { var url = ''; var url2 = ''; if (document.ExamPost.ExamPassword .value == "") { alert("Please enter a password.") return false; } url2 = '&ExamPassword=' + document.ExamPost.ExamPassword. value; url += '/ec/exm2/StudentBeginExam.learn'; url += '?CourseID=2169391'; //url += '&BeginExam=1'; url += '&ExamPKID=1370799'; url += '&UnitNumber=10'; url += '&CoID=48'; url += url2; top.Content.location = url; } //-->
Spoofing your name in posts … • Javascript is client side • Easily manipulable, if you have webspace to use … • Copy the source of the page • Change the hardcoded names • Comment out the verification function at the top • Upload • Run • Don’t forget: relative vs. absolute paths
The Validation Function … function validate(f) { if (submitted) { return false; } // if (f.message.value=="") { ttrack 13518 if (CRTrim(f.message.value)=="") { //ttrack 13518 alert('Please add text for this thread.'); f.message.focus(); return false; } submitted = true; //11/21/00 bugtar 991 if (f.FILE.value!="") { document.StatusUser.submit(); } //11/21/00 end return true; }
The hardcoded name … • <tr class="tr-content-light"> <td class="td-content-dark" align="right"><strong>First Name :</strong></td> <td class="td-content-dark">Marcial<input type="hidden" name="firstname" value="Marcial"></td> </tr> <tr class="tr-content-light"> <td class="td-content-dark" align="right"><strong>Last Name :</strong></td> <td class="td-content-dark">White<input type="hidden" name="lastname" value="White"></td> </tr>
Problems … • Password protected tests • Hum …. I guess that’s it.
Disclaimer … • White hat vs. Black hat • I do this so it will get fixed • Pretty cool eh? • Questions?