My Blackhat stories- How I hacked a college and paid my friend's fees

Intro:

I was always not an ethical hacker, bearing the word ethical in mind. I used to create a lot of fuzz and get things done my way. I have a lot of stories from hacking my school to governments but this is one of my favorites.

BACKSTORY:

My friend is studying bachelor's in Pharmacy from a well-reputed college. This college is popular and asks my friend to clear the fees. My friend’s father recently died in covid(beginning) and his mother was supporting the family. Needless to say, it was a huge burden to pay the fees. My friend was sent a notice that his degree would be canceled if the fees is not paid as he would not be allowed to sit for the exam. He reached out to the college and they said that nothing could be done. He was desperate and cries on the call. Im normally very realistic and suggested him various options but seeing his desperation, i thought of looking at the college.

I did not perform any recon as the admin login was right there, now I thought of trying out XSS and somehow stealing the cookies but to my notice came that the website was quite insecure so I thought of SQL injection.

SQL INJECTION:

So initially I tried the most generic login bypass and with manual enumeration, one just worked. PAYLOAD: ‘or’1'=’1'#, if you don't know about SQL injection, it basically checks if the parameters = TRUE. Thus by supplying it with an always true check, the answer returns TRUE and we get logged in. (AS 1=1), the # sign comments out anything which is irrelevant after the check.

Gained access, and now we have to figure out how to pay the fees of my friend which was easier than ever. You know why?

At this point, my heart is racing, my friend is watching in sheer horror. I go to fees collection and search his phone number, I cleared the due fees and gave a random receipt.

Now I'm worried about whether this will work or not, but on the 2nd day, he receives a confirmation that his fees are cleared. Now i again being a hacker explored other areas of this, and compromised every single student and professor's details such as phone number and identity card along with the address.

CONCLUSION:

Did I get caught? It was back in 2020 and now it's 2022, fortunately, my friend has graduated with his bachelor's and thanks me to date. I'm proud of what I did? No! I do not encourage anyone to perform this kind of hacking and stay on the good side. I would also like to apologize to anyone who found this horrible as this is not the type of content I generally write but it's a cool story regardless. Stay curious and safe. Lemme know what you think about this before you add this story to a list:) — Ravaan