My Blackhat stories- How I hacked a college and paid my friend's fees

I was always not an ethical hacker, bearing the word ethical in mind. I used to create a lot of fuzz and get things done my way. I have a lot of stories from hacking my school to governments but this is one of my favorites.

BACKSTORY:

My friend is studying bachelor's in Pharmacy from a well-reputed college. This college is popular and asks my friend to clear the fees. My friend’s father recently passed away due covid(beginning) and his mother was supporting the family. Needless to say, it was a huge burden to pay the fees. My friend was sent a notice that his degree would be canceled if the fees is not paid as he would not be allowed to sit for the exam. He reached out to the college and they said that nothing could be done. He was desperate and cries on the call. Im normally very realistic and suggested him various options but seeing his desperation, I thought of looking at the college.

Admin login

I did not perform any recon as the admin login was right there, now I thought of trying out XSS and somehow stealing the cookies but to my notice came that the website was quite insecure so I thought of SQL injection.

SQL INJECTION:

So initially I tried the most generic login bypass and with manual enumeration, one just worked. PAYLOAD: ‘or’1'=’1'#, if you don't know about SQL injection, it basically checks if the parameters = TRUE. Thus by supplying it with an always true check, the answer returns TRUE and we get logged in. (AS 1=1), the # sign comments out anything which is irrelevant after the check.

SQL injection

Gained access, and now we have to figure out how to pay the fees of my friend which was easier than ever. You know why?

Fees collection

At this point, my heart is racing, my friend is watching in sheer horror. I go to fees collection and search his phone number, I cleared the due fees and gave a random receipt.

Now I'm worried about whether this will work or not, but on the 2nd day, he receives a confirmation that his fees are cleared. Now i again being a hacker explored other areas of this, and compromised every single student and professor's details such as phone number and identity card along with the address.

CONCLUSION:

Did I get caught? It was back in 2020 and now it's 2022, fortunately, my friend has graduated with his bachelor's and thanks me to date. I'm proud of what I did? No! I do not encourage anyone to perform hacking without permission. I would also like to apologize to anyone who found this wrong as this is not the type of content I generally write but it's a cool story regardless. Stay curious and safe. Lemme know what you think about this story and should i write few blackhat stories too? Anyway clapping is optional— Ravaan

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Ravaan

Ravaan

1.1K Followers

CEH(Practical),Red Teamer/BBHH. Have hacked Governments to fortune 500 companies/UN. Hunt of CVEs occasionally with my team.CVE-2022-30076. Bookworm