Hacker News Reader

Comment by michaelmcmillan | Hacker News Reader

Not all that related, but we found an exploit in Blackboard (the "virtual learning platform") by smuggling null bytes (0x00) via. their WebDAV protocol.

This made it possible to hijack other accounts, including our professors'. So we hacked our own grades and then reported it.

Blog post here: https://bustbyte.no/blog/how-we-hacked-blackboard-and-change...

View on HN

Less exciting, but I found with some reverse engineering that School Loop (basically the same thing as Blackboard) has a WebDAV interface for their "Locker" (file storage for classes) interface. When I was working with it, I was finding that my queries did not work correctly; apparently their client for it did not work either because implementation was borked (which took a while to figure out!). AFAIK they never did fix it once I reported it to them, but the official client ended up being pulled at some point leaving my implementation the only interface to it that I know of…

Student here. We use SchoolLoop at my high school and the locker feature has been a pain. Just wanted to thank you for your work on Break. I recommend it to people all the time (plus, it's open source!)

Thanks; it's nice to see that people still find break useful. It's gotten somewhat difficult to work on, as I no longer have a live account to test with nor do I use the app anymore, so there are some bugs that have driven me up the wall for years but I can't figure out how to fix. I'll try to keep it running for as long as I can; maybe someone else will be able to figure it how to fix the issues ;)

Since I have a live account, expect a few PRs soon, once I get familiar with the code :)

Reply on news.ycombinator.com