Live data from Hacker News

How I Hacked My University's Registration System with Python and Twilio

twilio.com

11–20 of 163 posts

Re: How I Hacked My University's Registration System with Python and Twilio

#11
post #3
post #2

Probably the word "hacked" made it click baity, atleast in my opinion. Automation, yes. Not sure there was a vulnerability involved.

A 'neat hack' is the original use of the word hack. Hacking does not at all require the involvement of vulnerabilities.

Agreed, but it's just automation at play here. Clever, and will save time though, just thought that the headline was a little misleading, considering a registration system was involved.

Re: How I Hacked My University's Registration System with Python and Twilio

#12

This is an interesting proof of concept. I'm impressed at how simple the SMS signup code is. For many universities though, it won't be this simple. Many hide the open seats behind a login, which means you need to be a student there to see them. Many also use student information systems that are a real pain to scrape like this. Once you get to the point where interacting with the student information system is done via…

Author here--you're totally right. When we did this for our actual registration site, we spent hours inspecting requests in a proxy[0] to get to ~194 lines of PHP.

0: We used https://www.charlesproxy.com/

Re: How I Hacked My University's Registration System with Python and Twilio

#13
post #10
post #4

Earlier quoted context omitted.

Eh, I haven't read the article but I'm pretty sure hacking is doing something outside its intended purpose.

Agreed, but it's just automation at play here. Clever, and will save time though, just thought that the headline was a little misleading, considering a registration system was involved.

Apologies for the mislead! When I titled this, I imagined talking a lot more about stepping through the registration system in something like mitmproxy to find the exact requests to send, which feels a lot closer to hacking/reverse engineering. I ended up not really talking about that, but neglected to change the title.

Re: How I Hacked My University's Registration System with Python and Twilio

#15
I did this for one of my classes as well. But since it was just a one off, I just put this bash script in a cron job on a free-tier AWS ec2. It just did a quick and dirty parse of the html, which for my university wasn't behind a login wall.

  $seats="$(curl $URL | sed \"140qd\" | sed -nE \"s/|//gp\")"
  if [ $seats -gt 0 ]; then
      echo "Go register for class $URL" | msmtp -a "default" $EMAIL
  fi

Re: How I Hacked My University's Registration System with Python and Twilio

#16
I remember I made this same thing when I was in undergrad b/c my uni didn't have waitlists. So people could waitlist on my app. Their priority in the waitlist is determined by a market.

I remember getting SMS's in the middle of the night alerting me that a seat opened up!

Re: How I Hacked My University's Registration System with Python and Twilio

#18
Wondering why you didn't also automate the process of actually signing up for the seat? Getting notified that a seat is open is helpful but automatically taking the open seat sounds a lot more helpful.

Though at that point you'd have a lot more luck with selenium or some other web driver.

Re: How I Hacked My University's Registration System with Python and Twilio

#19

Wondering why you didn't also automate the process of actually signing up for the seat? Getting notified that a seat is open is helpful but automatically taking the open seat sounds a lot more helpful. Though at that point you'd have a lot more luck with selenium or some other web driver.

Sometimes universities have weird rules about automating the actual sign up process versus automating being notified.

Re: How I Hacked My University's Registration System with Python and Twilio

#20
post #8
post #2

Probably the word "hacked" made it click baity, atleast in my opinion. Automation, yes. Not sure there was a vulnerability involved.

It's also a bit risky, as some University administrators may not understand that he isn't actually being malicious. Automated scraping can be considered a violation of some IT policies though, so OP should be careful about something like this.

I'm in higher-ed infosys and we see a number of automated registration sniping hacks in our monitoring / metrics. We usually don't run it up the chain unless it's malicious or impacting the service for other students. Otherwise we just investigate it a little bit and share it on Slack with the group if it's clever. The only time we've ever reached out to a student is to ask him to stop sharing it with others (and fix it) because it was performing some really aggressive polling.

Some other schools in our system are really reactionary, though, and consider any automation a ToS violation and will freak out.

e: And if you know the URL pattern / platform of your Uni's registration system, there's probably already a couple of examples on github of a registration bot.

Post reply on HN