ECollege Hacking

1
ECollege Hacking

• Marcial White

2
Introduction

• Client Side vs. Server Side
• Javascript
• POST vs. GET

3
Howto Retake tests

• Using simple URL manipulation
• . Thats pretty much it.
• Examine the source code
• Rebuild the URL with the pertinent variables
• Hit enter

4
Look for this chunk of Javascript

• lt!-- function BeginExam() var url '' var
  url2 ''
• if (document.ExamPost.ExamPassword .value
  "") alert("Please enter a password.") return
  false
• url2 'ExamPassword' document.ExamPost.Exam
  Password. value
• url '/ec/exm2/StudentBeginExam.learn'
• url '?CourseID2169391'
• //url 'BeginExam1'
• url 'ExamPKID1370799'
• url 'UnitNumber10'
• url 'CoID48'
• url url2 top.Content.location url //--gt

5
And you get.
6
THESE guys .
7
Spoofing your name in posts

• Javascript is client side
• Easily manipulable, if you have webspace to use
  
• Copy the source of the page
• Change the hardcoded names
• Comment out the verification function at the top
• Upload
• Run
• Dont forget relative vs. absolute paths

8
The Validation Function

• function validate(f) if (submitted) return
  false // if (f.message.value"") ttrack
  13518 if (CRTrim(f.message.value)"") //ttrack
  13518 alert('Please add text for this thread.')
  f.message.focus() return false submitted
  true //11/21/00 bugtar 991 if (f.FILE.value!"")
  document.StatusUser.submit() //11/21/00 end
  return true

9
The hardcoded name

• lttr class"tr-content-light"gt lttd
  class"td-content-dark" align"right"gtltstronggtFirs
  t Name lt/stronggtlt/tdgt lttd class"td-content-dark"
  gtMarcialltinput type"hidden" name"firstname"
  value"Marcial"gtlt/tdgt lt/trgt lttr
  class"tr-content-light"gt lttd class"td-content-da
  rk" align"right"gtltstronggtLast Name
  lt/stronggtlt/tdgt lttd class"td-content-dark"gtWhitelt
  input type"hidden" name"lastname"
  value"White"gtlt/tdgt lt/trgt

10
The outcome
11
Problems

• Password protected tests
• Hum . I guess thats it.

12
Disclaimer

• White hat vs. Black hat
• I do this so it will get fixed
• Pretty cool eh?
• Questions?