How I Infiltrated the University Database, Teetered on the Brink of Expulsion, and Struck Gold in the End.

Hello, dear readers. Today, I will share the story of how I gained access to my university’s database while pursuing my master’s degree. The information I obtained included details about teachers, students, and staff members. As a bonus, I’ll reveal my surprising reward at the end of this article. Enjoy the read.

Note: My intention in sharing this story is not to encourage such actions but rather to raise awareness about potential vulnerabilities and the importance of safeguarding oneself and one’s organization.

My journey began with the accidental discovery of a professor’s password from the university I attended, which I stumbled upon at “https://intelx.io/." Armed with this information, my first step was to locate the teacher portal through subdomain scanning.

Upon accessing the teacher portal, I initiated the process of capturing all requests using Burp Suite, and that’s when I began to explore the portal’s inner workings.

While examining the queries, I came across the “id” parameter. My initial focus was on checking for SQL injection, and I quickly identified an error.

At this point, my curiosity led me to run SQLMap to further investigate the issue.

With the problem now identified, let’s delve into the data.

sqlmap -r req --time-sec 10 -p id --dbs

In summary, I hope my actions and their consequences have been made clear. Naturally, I promptly reported the security flaw to the university administration and the IT department. They expressed genuine interest once I provided a comprehensive report and even granted me permission to share this article.

As I mentioned at the outset of this article, there was a significant reward involved. To reveal it: if I were to engage in such activities again, expulsion from the university would be the consequence. I am grateful that they chose to give me a second chance, and I value it deeply. :)

In closing, I’d like to impart a piece of advice: never conduct any form of scanning without proper authorization, not even a simple port scan. My experience with this incident taught me that even well-intentioned actions can inadvertently harm others. Stay vigilant, and always obtain permission for your penetration tests. Stay safe!