Hack your grades

Dr Katie Paxton-Fear shows us how to hack the Generic University and change grades using the university API. You will learn some of the OWASP top 10 vulnerabilities including Broken Object Level Authorization and Broken User Authentication.
Disclaimer: We are hacking the Generic University for educational purposes only. Generic University is a GitHub project that Katie has created to learn Cybersecurity and APIs. Do not hack a real university.
// University //
The Generic University on GitHub: github.com/InsiderPhD/Generic...
// MENU //
00:00 - Coming up
01:16 - Katie's KZbin channel // Recommended playlists
02:31 - How to hack and change your grades // "Generic University"
03:26 - Generic University demo // Burp Suite
04:25 - API vulnerabilities // Bug bounty
07:50 - Generic University demo (continued)
21:27 - Thinking outside the box // Hackers mindset
25:34 - Katie's PhD
26:10 - Will AI take over?
29:42 - Advice for getting into cyber-security
34:01 - Recommended KZbin playlists
35:44 - Recommended sites and books
36:48 - Conclusion // Final words
// Videos discussed //
Everything API Hacking: • Finding Your First Bug...
Hacker Toolkit: • How to use ffuf - Hack...
Burp for Beginners: • Burp for Beginners: In...
OWASP Top 10 owasp.org/
// Books //
Hacking API’s by Corey J Ball: amzn.to/3JOJG0E
Bug Bounty Bootcamp Vickie Li: amzn.to/3SPCtBF
// Free API hacking course //
APIsec Certified Expert Course: university.apisec.ai/
// Katie's Social //
Twitter: / insiderphd
KZbin: / insiderphd
Website: insiderphd.dev/
The Generic University on GitHub: github.com/InsiderPhD/Generic...
// David's SOCIAL //
Discord: / discord
Twitter: / davidbombal
Instagram: / davidbombal
LinkedIn: / davidbombal
Facebook: / davidbombal.co
TikTok: / davidbombal
KZbin Main Channel: / davidbombal
KZbin Tech Channel: / @davidbombaltech
KZbin Clips Channel: / @davidbombalofficialclips
KZbin Shorts Channel: / @davidbombalshorts
Apple Podcast: davidbombal.wiki/applepodcast
Spotify Podcast: open.spotify.com/show/3f6k6gE...
// MY STUFF //
www.amazon.com/shop/davidbombal
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: [e-mail]
// Generic University Challenge //
Vulnerabilities:
API1:2019 Broken Object Level Authorization
API2:2019 Broken User Authentication
API3:2019 Excessive Data Exposure
API5:2019 Broken Function Level Authorization
API6:2019 Mass Assignment
API7:2019 Security Misconfiguration
Your Goals:
- Find the emails of the administrator
- Brute force the API to find new endpoints
- Find out what grades everyone got in a class
- Edit someone's grade
- Make an account
- Access the GraphQL API
- Change another account's password
- Login to your account
- Access admin API
- Find out what vulnerabilities the IT admins have ignored
- Make your account an admin
- Access the admin control panel
- Fire a blind XSS in the admin control panel and validate with your new admin account
- Delete everything
- Restore everything
hacking university
hacking school
hack school
hack university
hacking api
api
api hacking
api hacking tutorial
api hacking bug bounty
api hacking 101
api hacking full course
Disclaimer: This video is for educational purposes only. I own all equipment used for this demonstration. No actual attack took place on any websites.
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
#api #hack #hacking

[@davidbombal]

Dr Katie Paxton-Fear shows us how to hack the Generic University and change grades using the university API. You will learn some of the OWASP top 10 vulnerabilities including Broken Object Level Authorization and Broken User Authentication. Disclaimer: We are hacking the Generic University for educational purposes only. Generic University is a GitHub project that Katie has created to learn Cybersecurity and APIs. Do not hack a real university. // University // The Generic University on GitHub: github.com/InsiderPhD/Generic-University // MENU // 00:00 - Coming up 01:16 - Katie's KZbin channel // Recommended playlists 02:31 - How to hack and change your grades // "Generic University" 03:26 - Generic University demo // Burp Suite 04:25 - API vulnerabilities // Bug bounty 07:50 - Generic University demo (continued) 21:27 - Thinking outside the box // Hackers mindset 25:34 - Katie's PhD 26:10 - Will AI take over? 29:42 - Advice for getting into cyber-security 34:01 - Recommended KZbin playlists 35:44 - Recommended sites and books 36:48 - Conclusion // Final words // Videos discussed // Everything API Hacking: kzbin.info/www/bejne/r3S4gnWZZ9eMb7s Hacker Toolkit: kzbin.info/www/bejne/l3-Wf5Svq8lqfLc Burp for Beginners: kzbin.info/www/bejne/i5jFiqKwfplmbK8 OWASP Top 10 owasp.org/ // Books // Hacking API’s by Corey J Ball: amzn.to/3JOJG0E Bug Bounty Bootcamp Vickie Li: amzn.to/3SPCtBF // Free API hacking course // APIsec Certified Expert Course: university.apisec.ai/ // Katie's Social // Twitter: twitter.com/InsiderPhD KZbin: kzbin.info Website: insiderphd.dev/ The Generic University on GitHub: github.com/InsiderPhD/Generic-University // David's SOCIAL // Discord: discord.gg/davidbombal Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZbin Main Channel: kzbin.info KZbin Tech Channel: kzbin.info/door/ZTIRrENWr_rjVoA7BcUE_A KZbin Clips Channel: kzbin.info/door/bY5wGxQgIiAeMdNkW5wM6Q KZbin Shorts Channel: kzbin.info/door/EyCubIF0e8MYi1jkgVepKg Apple Podcast: davidbombal.wiki/applepodcast Spotify Podcast: open.spotify.com/show/3f6k6gERfuriI96efWWLQQ // MY STUFF // www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [e-mail] // Generic University Challenge // Vulnerabilities: API1:2019 Broken Object Level Authorization API2:2019 Broken User Authentication API3:2019 Excessive Data Exposure API5:2019 Broken Function Level Authorization API6:2019 Mass Assignment API7:2019 Security Misconfiguration Your Goals: - Find the emails of the administrator - Brute force the API to find new endpoints - Find out what grades everyone got in a class - Edit someone's grade - Make an account - Access the GraphQL API - Change another account's password - Login to your account - Access admin API - Find out what vulnerabilities the IT admins have ignored - Make your account an admin - Access the admin control panel - Fire a blind XSS in the admin control panel and validate with your new admin account - Delete everything - Restore everything Disclaimer: This video is for educational purposes only. I own all equipment used for this demonstration. No actual attack took place on any websites. Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

[@dareilcasinojamerojr.4134]

Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this??? from philippines....

[@SolitaryElite]

i tried to do that by hacking my teacher but you can only add grades not edit, and adding good grades out of nowhere is just sus asf so :(

[@game_vloger0]

Sir hack IGNOU website

[@megatee4018]

@@SolitaryElite don't worry about that I have someone who can do that for you

[@megatee4018]

@@SolitaryElite don't worry about that I have someone who can do that for you

[@impostorsyndrome1350]

the fact that you provide all of this for free is truly astounding. Keep it up, it's really cool!

[@chelography4410]

Thank you for your channel and thank you Katie for your insight and encouragement.

[@davidbombal]

Thanks for watching!

[@RustyShacklefordddd]

Another great video David ive been binge watching your videos since Tuesday!

[@BobBob-qm2bm]

David B. has done it again! Dr Katie is FEAR-less while hacking those APIs. You are rocking the content and presenting awesome guess. Thank you for being a blessing to the community. 🤓👨‍💻

[@mr.docker7699]

I didn't know much about BurpSuite before watching this video. I am improving my knowledge because of you. Thank you so much Mr David 🙋‍♂

[@ariasm8911]

i saw several video of yours today and realized you are phenomenal interviewer, questions are spot on. thank you David!

[@dejuridico1691]

Great guest as always, David!. Greetings from Mexico City.

[@trscsaeg]

Love how david controls conversations and keeps experts from going to far over people’s heads

[@arghyl]

Another great guest! thank you!

[@ITExplorer-X]

Great video and an eye opener. Thank you for the information.

[@jspiteri33]

Thanks guys so much great information. Keep up the great work

[@NAKAEtekq]

Haven't watch to the end but I'm already loving it.....thanks david

[@funkymonk2254]

ThankYou David and Dr. Katie.

[@mattjohnson6276]

Katie seems pretty awesome! Thanks for bringing her on.

[@shayansec]

I can't thank you enough for providing this vid... Actually I was learning IDOR vuln and want to practicing on Generic University but can't find any resource about it...searched and this just got appeared.

[@lovejko]

Love people, who have the talent to explain. Thank you.

[@luizcosta8122]

Everytime David posts a video, my dream of living off hacking and bug bounties becomes stronger

[@esaelvladimir3672]

Eagerly and literally need this from you Mr David

[@davidbombal]

Hope you enjoy the video. Please only hack the generic university - not a real one.

[@nathanaelhassin7729]

It's so amazing how you help people out with your service. Continue the good work

[@nathanaelhassin7729]

XDRHAC

[@nathanaelhassin7729]

IS THE BEST HACKER

[@tyrojames9937]

When Katie told the story about her mother being TERRORFIED of Computers, That part HIT HOME!😊

[@ArturoGonzalez-uz1by]

I’m going to go hard into bug bounties during my winter break in two weeks, thank you David!!!

[@MFoster392]

Another great video, thank you

[@hunte-shovelton]

Feeling so inspired and positive after this recommendation , thanks!

[@hunte-shovelton]

Xdrhac

[@hunte-shovelton]

Best hacker for school grade hack

[@CyberNancy]

In my youth, hacking my grades would have been the only chance I had to get high marks.😂

[@msascuinonducorduco]

😂 I would have done the same thing especially with non technical courses 🤦🏾‍♂ still don't know why in this day and age we have to take those... I had to take: Philosophy 🤨, Home Ec 🗿Social Studies 🙄, and much more. Still no technical courses yet... until I'm a Junior 😔 Woe is me...

[@davidbombal]

lol

[@hus73928]

but cool high marks

[@bubz3t136]

@@davidbombal Is this for real? I'm 47, so I missed out on all of this. How common is grade-hacking? Is there really no way of getting caught? How much does it cost to get a hacker to do it for you?

[@ishwartaral9019]

Sir Can you hack my grades please 🥺🙏🏻 to get only pass 😭 I don't want high marks but only pass please sir 🙏🏻 I can give you money 💰 also whatever you want 💯

[@alonzosmith6189]

Thanks for sharing, hopefully this will educate schools on what not to do and what to look for and what they should do to secure their systems.

[@davidbombal]

Agreed Alonzo. Let's hope so.

[@darwintean4861]

Let's hope not😈

[@ItzHerobrine]

@@darwintean4861 xd

[@abhijithsuren]

Finally it's here ❤️

[@aniketsadal]

Love from India sir❤️ Your content is amazing it helps me a lot

[@serialkiller8783]

do a video of how to stay consistent? i like your consistency of posting new quality content videos.

[@mohamedmounir6770]

At the right time👌. During this week I will pass my first term exams😂😂. Mr.david you're a mind reader 😆

[@davidbombal]

lol... please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)

[@tyrojames9937]

I HAVENOT BEEN DISAPPOINTED WITH A VIDEO FROM THIS CHANNEL YET!👔🎉

[@endlesscarrow]

Please awaited to hear from you

[@Ataraxia_Atom]

This is actually how I graduated early. I went to a remedial highschool and we had to take multiple classes online. Well the teacher had to reset our tests/change grades if we didn't pass with his password at our console. Well I saw his password one time and was able to login and change many of my grades to show that I had passed a bunch of tests I didn't to take. I was so done with highschool

[@parryhotter9333]

i mean, you could just study and pass the tests 🤡

[@Ataraxia_Atom]

@@parryhotter9333 I mean when you're 16 and done with school, you do what is easiest to get where you want to go. HS is a giant waste of time in the US anyway and I was able to graduate about a year early so

[@ipodtouch470]

@@Ataraxia_Atom hs is not a complete waste of time if you want to get into tech in college. All that math came into effect when I was building a game with real physics.

[@Ataraxia_Atom]

@@ipodtouch470 you're not wrong, there is definitely value to be had if it's the right time, but nothing that can't be learned later in life. I didn't start to settle down until i was 22, an now i work as an engineer in the semi conductor industry, previously in aerospace

[@RAMADHANIBARAKASHALA]

​@@Ataraxia_AtomHello

[@december8421]

very cool! more videos like this)

[@ssf_9]

Massive Respect David sir.. 🙏

[@oproadiakdajdbhjadajsld]

HOLY MOLY I NEED IT

[@ZainBhaiiii]

Thank you so much David for bringing such a video i hope this will help me. I just want to know is it possible on the real website?

[@davidbombal]

As Katie said in the video, she finds these vulnerabilities in lots of real websites. Make sure you do this legally by joining a bug bounty program to be paid to hack real companies safely.

[@ZainBhaiiii]

@@davidbombal Thank you so much for reply. You are a best teacher in the world

[@upelister]

Great video, thanks.

[@ergogenda3374]

Great guest as usual. I subscribed to her channel.

[@shaikjilani8242]

What is her youtube channel name?

[@GentlemanPro-zz2ke]

Hello Mr David and Dr Katie, I'll like to ask, what if the website your trying to test does not have an API and you are only able to use burp suite. What will you advice you do in such situation.

[@Xvics]

David, your video is great. Please make more videos with Katie; I adore the way she explains things.

[@hendahmed2408]

is it still not working😢? iam starting my pentesting course, i have mac m1pro so u think i should seal it and buy windows?beacuse as you say some tools doesnt work?

[@edwin_terrones]

I’m already subscribed and I have learned a lot from her she’s great!

[@davidbombal]

Agreed Edwin!

[@pushparajpraveen5340]

When you realise you need to study to hack your grades just to compensate for what you not done before your exams......

[@davidbombal]

In tech you never stop learning. Best to learn how to learn as it won't stop.

[@ameraa775]

@@davidbombal Can you help me about adjusting grades

[@excaliber2845]

in a prev video you said you will be showing what you can do with the kali nethunter termux but you haven't even mentioned it since, have you forgotten or have u decided it isn't worth making a video about?

[@maniakdemi3548]

Hi David... I recently watched your video on how to install Kali nethunter on an android phone. After completing all the steps and installing nethunter kex. I'm unable to connect openvpn and network manager is disabled. Do I need to root my phone in order to get it enabled?

[@Mp-jw1qg]

my highschool used Aeries software , in 2003 i figured out how to access the master accounts by bypassing the schools user login system that ran across every pc on campus. I made a usb that would boot full version of windows isntead of the schools version between bios and windows level. I was able to bypass all the internet filters and had full access to the pc's. It took the cisco networking teacher/class 2 years to figure it out. All of the Teacher computers were all named uniquely since they were the only ones who were able to name the pc's so it was very easy for us to get into the network and see wich physical devices were the teachers lol. The school used to put black rubber film over the keyboards in typing class and the software would keylog EVERY key stroke and judge typing accuracy. it would dump the logs to a central PC that was setup. we found the economics teacher had logged in to a student pc, and logged into Aeries so we logged into his account and changed a bunch of peoples grades, and also took Aeries down for about 4 months by changing the teachers login and passwords. deleting the excel files that aeries would store etc etc. We got suspended and i didnt get to walk across stage at graduation because of it. I got kicked off the baseball team, water polo team etc. I got in a ton of trouble and wasnt allowed to use any Pc at school for the rest of the time i was there. the teachers could never figure it out, i got ratted on by someone whos grades we changed.

[@user-ex7mw8gp8f]

Very interesting, what are the website, tools to start as a beginner please I your help take me through all this

[@Firoz900]

I subscribed Katie.

[@adventurenewzealand]

I used an system i set up to rewrite excellence (a+) work exemplars supplied by the education system where i live. The system found synonyms for all applicable words. Step two was to put it through a text summarizer. 3 was a stolen text checker. Allways got a plus

[@bubz3t136]

So you got away with? Could you help a kid in the UK?

[@nineb7640]

Hi David,thank you very much for the great content,I love all your subjects that you bring up to the table I just wana to mention if possible that you talk about decentralized VPN and if you can get some experts to talk about it ( cause I see a very good project called deeper connect) you can search about it of course I see it as very interesting kind of technology in these days. Thanks a lot again for everything I learnd alot from you and your video. All the best

[@islamicspirit5956]

love it

[@davidbombal]

Glad you enjoy the videos :)

[@Joel-gf4zl]

I was fully capable of changing any grade in high school, but never stupid enough to actually do it. They even stored all students locker combinations on a central server, so if I wished, I could open any locker. Good times.

[@abdullahomer14]

Teach me.

[@0ninja213]

@@abdullahomer14 U need to find a vulnerability first

[@user-xr3gp6es7v]

Can I contact your team to change my undergraduate grades please

[@michaellasambouw]

It would be nice to having Katie on your KZbin David. Thanks for sharing Katie

[@dareilcasinojamerojr.4134]

Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this???

[@fahimanayet]

loved it

[@endlesscarrow]

Like the people you interview with anyone who will love to teach I want to be an ethical hacker or cybersecurity but don’t know where to learn it

[@Goosht]

hahahaha 24:24 I was listening so attentively and the B roll and caption killed me!

[@mu3076]

I'm doing my Masters Degree in Computer engineering and I hate it. I want to switch to information security but here in Russia foreigners are not allowed to study infosec for whatever reasons... I'm dying from the inside doing what I don't love... I don't know what to do

[@glitchinthematrix9306]

Bro stop doing it

[@mu3076]

@@glitchinthematrix9306 I have no other options, No jobs in Africa back home. I just have to suffer through this whole thing...🤦🏽‍♂️🤦🏽‍♂️🤦🏽‍♂️

[@hendahmed2408]

is she using mac m1or m2 please answer me

[@Sentient.A.I.]

I hacked into my schools network when I was in middle school. I didnt change a single grade but the school wanted to expel me. They failed in this but still it managed to cause enough trouble to ruin my early hacking career.

[@landonmiles293]

how?

[@RapsyJigo]

I like to tell my students who always ask about hacking the best hack I ever done. About ~13 years ago when you would go to the bank and ask for an account and you would ask for internet control of that account (internet was kinda new here so not everyone had it by default) the bank would obviously make an account for you and give you the first time credentials to said account. Now the thing is they gave you the credentials on a sealed piece of paper, most people would take the piece of paper with them home, log in and then change their passwords. But not everyone, some people decided that they'll write down the credentials in their personal notebook for easy memory and just throw the credential paper away. I guess you can see where this is going, I just stood outside the bank, and waited for someone to throw away pieces of paper. Dumpster dive for them and like 1/1000 you're gonna hit the jackpot.

[@mikedc]

The movie wargames in the 80s was the first time I seen this practice...he was in high school changing grades

[@davidbombal]

For the real world, please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)

[@cdcrjp2nft867]

How do I get the university to process my student loans

[@gulmonpradhan]

Please help me 😭

[@ybfc311]

this was a great talk... 👍🏼 will be def looking into more api stuff

[@innokirigiti]

This is 100% true, I also once hacked a voting system website just by replacing /login with /register. It turned out I was able to register as an admin, it was the simplest yet powerful hack I used before.

[@ModemMage]

Great video. I'm a network engineer trying to become a little more broad and I'm definitely subbing to insiderphd

[@monkeydluffy9933]

I remember doing this with just social engineering and a Bad USB attack as the college servers were too easy to access

[@Techme239]

Is it possible to hack radio FM

[@pradnyabugdane8287]

Please tell me process to hack write protected sd card to retrieve data

[@maximillianus5453]

name of software for Mac ?

[@marwanharby5251]

what if i didn't find the api ?

[@daboijason9466]

Cant wait to add a bit of bruteforce and loads of proxies for deauth countermeasures

[@theMadhatter817]

Just subbed to her channel

[@Shadowofher]

I have attention deficit disorder. All this time I've been saying, look at what Katie's saying, now watch out - now David. Okay, okay, no, don't look at the green creature on the shelf behind Katie. Listen... Very good, I was so proud of myself and then all of a sudden - spongebob speaking spanish ! 🤣🙈

[@AchiTechIsolutions]

How to bypass iphone 6splus hello sreen

[@TRS6328]

Which course should I do in ethical hacking or cyber security?

[@robeldesta4926]

EH

[@TRS6328]

@@robeldesta4926 r u learning EH

[@robeldesta4926]

@@TRS6328 yes

[@TRS6328]

@@robeldesta4926 Till now how much hacking you have learned means if EH is 100% then what % you have learned

[@TRS6328]

@@robeldesta4926 hey bro tell me how i contact you

[@mereculescomeback9544]

this sounds silly, but I appreciate her work

[@grandmagician4798]

Hello Mr. bombal can you please make a video on installing kali Linux on a Samsung galaxy device with android 12

[@grandmagician4798]

@Add-on-Techlore01 yes can you contact me

[@rationalbushcraft]

I have used burpsuite but never considered looking at APIs like that.

[@Travel_-_-_-_]

book pdf link?

[@ushayadav8614]

This is something incredible 🌝

[@statuscreator3522]

What is this debugging app ??

[@medhasni6432]

any smart contract content David??

[@albertma4875]

Not going to lie this sounds like a good way to get kids into cybersecurity

[@salamlacin4715]

What does it mean to have a rabbit in the control system

[@zentraidee9701]

"Be an information Sponge"-Dr. Katie Paxton

[@MikiasTeshome]

Greating from Ethiopia

[@mranthony1886]

7/11/2022 - At Twitter, as well as at some banks, the answer appears to be lines of code. - Good engineers produce a lot of them.... never mind security which is more considered...

[@lohphat]

THIS is what blockchain should be used for: Creating an immutable ledger so that entries cannot be changed.

[@TheShadowCamo]

I actually graduated from Generic University. I got a degree in Translating British to English.

[@vardhangoud8851]

Now I am gonna change my grades. Inspiration: Thank you David sir

[@davidbombal]

Please only hack the generic university - not a real one Vardhan. Or join a bug bounty program to be paid to hack real companies :)

[@theloser3965]

Sir, I am from a non-IT background, but I wish to start my career in ethical hacking I want to learn everything which is essential to become an ethical hacker and it is also my desire that you could like to be my mentor?

[@SmedleyButler1]

What's her yt channel name again?

[@Skilital]

my russian exams site still have a leak on the api thing, there is a .js file that shows all API listings on their website, made a script using python, and basically loaded all the answers before the exams using the updated cookie they gave. i finished 10-11 classes this August using the script. i use arch btw

[@sneil7879]

oh wow thats crazy

[@youz123]

where should I start if I want to learn that?

[@Skilital]

@@youz123 you can start with javascript, learning the basics and then getting into how websites use js on front-end, how API's and cookies work. learn how to use chrome's devtools (ctrl + shift + i), then read website's scripts and search for stuff. Took me several weeks accually to make my own tool.

[@balala7567]

arch user try not to say they use arch challenge (impossible)

[@keshi5541]

ofc you use arch linux.

[@jeremiahosagie6137]

Please can you help to hacky results

[@christopher3862]

But Would the school actually notice if one student out of 1000 changed there results though?

[@PUITKH]

❤