[QGK]

Hey all, recently my school launched something called "Magister", it uses Ms Silverlight, but longstory short, it allows students to see their on grades (on a webpage), and teachers to add/edit them, to get to it its like this:

http://www.schoolsite.com/ 'regular school site
http://schoolsite.swp.com/ 'grading page

the www has to go in order to load

ofcourse schoolsite is just an example,

Also the student logins are:
name: student number
pass: made up by student

teacher logins:
name: (probably) first names letter.lastname
pass: made up by teacher


I was thinking maybe brute forcing, or anything, but the pass can be lowercase & uppercase letters + numbers, and 3-10+ digits


Any help is greatly appreciated🎉

[HaviK]

Hi,
Brute forcing a 12 digit password that can only contain upper and lower case letters and numbers
takes 167298613310 years thats at 620 passwords a second.

I doubt that will work but I could be wrong!

Hav.

[QGK]

Any brute forcer download links please? Or good ones working

[hackersock]

you can get Brutus here: http://adf.ly/3ozPi
its old but it gets the job done!

Any brute forcer download links please? Or good ones working

[Daws0n]

Brute forcing is simply wastage of time, unless your teacher is a dumb ass and his password is something like "123456" or "password" or "mypass" etc. You would have to find better ways, to get hold of them. try Google for 'MS Silverlight exploit' or something similar.

[Maxitj]

Brute forcing is simply wastage of time, unless your teacher is a dumb ass and his password is something like "123456" or "password" or "mypass" etc. You would have to find better ways, to get hold of them. try Google for 'MS Silverlight exploit' or something similar.

I bet there are dumb teachers, not it ones but others ! ;)

[QGK]

For brute forcing, what login type is it?

HTTP:basic
HTTP:form
FTP
POP3
Telnet
SMB(Netbios)
Custom
Netbus

[QGK]

Bump

The page site wnds with .aspx, what brute force login type do I use (see prev post)?

[Phreak!]

Run cain and able and begin ARP poisoning. You should be able to get passwords that anyone logs in with on the network.

Be very very careful.

[quintes]

I'm trying this too, but Cain is not recognizing.

[Нyреrion]

Like a user above posted, sniff the packets. Make sure you don't poison for too long, or else you'll down the network.

[quintes]

*Silverlight what so ever. Not even as http