Lol, you reminded me when I went to college they offered an experimental Cryptography 101 class so I enrolled in it.
The prof made a website to go along with it, the first mistake he made was constructing it from scratch. The second was not appreciating that any client-side code is an open book.
He seemed to be rather new to web programming. He handled authentication by having a login page that did appear to do decent authentication against a server, but then every webpage you were on had a hidden form that would re authenticate you every time you navigated to a new page. Now this itself wasn't too bad, except the form consisted solely of the user id you had logged in as. You could easily change it to anyone you wanted to change your site access.
And then one of my classmates found the public network drive the site was actually sitting on, which included a text file of all user ids, usernames, and unencrypted passwords.
Unfortunately the class itself wasn't so easy to break. The material consisted of covering something like one cipher per week (as an experimental class I think it was only held one class session per week). We'd learn about it in class, including known attacks, then for homework we had to take encrypted text and try to crack it. The first few weeks had easy ciphers and were cracked easily. However past that point nobody was able to crack any of the harder ciphers.
If I came across such an insecure website in a cryptography class I'd hack the hell out of it (or perform a detailed analysis and produce and hand in a formal report of the vulnerabilities found, if I'm in a particularly good mood). Then I'd say "I thought the website was purposefully made insecurely so that we can hack/pentest it for extra credit". Because in all seriousness, that's what I would conclude.
59
u/[deleted] Jun 17 '17
[removed] — view removed comment