[q4ssam]

Hey yall,

I’m curious about gaining access to networks like school networks, so i can gain Access to the grades or anything thats available. I live in Germany, so it might be a bit different in the US. And The IT in that School is mediocore at best.
And yes I fully understand that unauthorized access is illegal and can have consequences, so please dont come to me with that.

Assuming one is the student representative/ head boy, what methods would be recommended to better understand the security architecture and to invade it? Like to get an overview of how the Network works etc.
What tools or resources would be useful for learning to identifying vulnerabilities, and which protocols or network segments are typically relevant in that kind of an environment?

Looking forward to your feedback and any suggestions for learning resources and tools!

Thanks in advance.

[DramaKing]

Hey yall,

I’m curious about gaining access to networks like school networks, so i can gain Access to the grades or anything thats available. I live in Germany, so it might be a bit different in the US. And The IT in that School is mediocore at best.
And yes I fully understand that unauthorized access is illegal and can have consequences, so please dont come to me with that.

Assuming one is the student representative/ head boy, what methods would be recommended to better understand the security architecture and to invade it? Like to get an overview of how the Network works etc.
What tools or resources would be useful for learning to identifying vulnerabilities, and which protocols or network segments are typically relevant in that kind of an environment?

Looking forward to your feedback and any suggestions for learning resources and tools!

Thanks in advance.

Number one: du bist einen Dummkopf.
Two: It's hard to answer without doing reconnaissance on the network. You already have access to the network (at least the student network), so that's not what you're actually looking for. It will take a lot of scanning and evaluating ways to gain remote access to devices in order to find what platform is being used for grades and to plant malware to steal credentials.
Three: Unless the school's computers are really old, there won't be a vulnerability that you can use.
Four: Don't change your own grades. You'd really have to be an idiot to think that no one would notice. The movie War Games is nothing like real hacking today.
Five: The only way that you're likely to succeed is to put in the years of work that it will take to learn.

[InspectorGadget]

Your school likely doesn't host the actual grading system on their network... everything is in the cloud these days - hence they hand out Chromebooks like they are candy.

You are going to gain access to the staff network at best and find nothing of value.

[washwad]

i dont live in germany/us but in my country a teacher logs into her account in the school network to enter grades maybe thats how it works in other countries. so maybe you can install a keylogger on a school computer which teachers use i know its not a good method but its something you can try to do. there is a lot of flaws in this method but it can be fast

[q4ssam]

Your school likely doesn’t host the actual grading system on their network… everything is in the cloud these days - hence they hand out Chromebooks like they are candy.

You are going to gain access to the staff network at best and find nothing of value.

Nah, it’s a bit different here. Grades and student data are on centralized servers. Teachers log in through their school profile, where they can edit grades, manage attendance, issue documents, and stuff like that. So it’s not your typical cloud setup, it’s more like a platform that every school connects to.

[SilentNuke]

I dont live in Germany so i may be way off track here, but where I live, grading is done by third parties and not held on the school networks, so even if you could gain access, it wouldn't help you.

As you said, what you are asking is illegal - again, speaking from my own country, not familiar with german laws, but I would imagine it would be the same so I would not recommend you pursuing this any further.

If you was to ignore the advice given, you would need to provide more information on your schools system and whats its running before anyone can give you any suggestions.. going in blind is never a good idea.

[q4ssam]

I dont live in Germany so i may be way off track here, but where I live, grading is done by third parties and not held on the school networks, so even if you could gain access, it wouldn't help you.

As you said, what you are asking is illegal - again, speaking from my own country, not familiar with german laws, but I would imagine it would be the same so I would not recommend you pursuing this any further.

If you was to ignore the advice given, you would need to provide more information on your schools system and whats its running before anyone can give you any suggestions.. going in blind is never a good idea.

I’m not really that familiar with the German system either( i will be in a few days), but from what I’ve gathered, the grading is heavily based on LUSD, which is the centralized school management solution for schools in Hessen(the state). This system manages all kinds of student data, including grades and teacher assignments and even graduation levels. Teachers have their own access credentials, and if someone managed to get a hold of those, they could easily manipulate grades(Like i know how some guy didnt look away when his teacher typed in his password and he changed his grade in Maths from an E to a B+ and cause of that he was able to graduate)

I know what I’m suggesting is illegal, and it typically has a three-year statute of limitations before it expires. But im really looking to explore this, i'd need to dig deeper into the specifics of the LUSD system and how the access controls are set up. Getting familiar with how the teachers manage their data and what vulnerabilities exist in their logins could be key. i would just need to know where to start with the basics of that so i can have a grasp on how to start

could be as easy to just steal the passwords ik, but its riskier to do that i think.

---

Number one: du bist einen Dummkopf.
Two: It's hard to answer without doing reconnaissance on the network. You already have access to the network (at least the student network), so that's not what you're actually looking for. It will take a lot of scanning and evaluating ways to gain remote access to devices in order to find what platform is being used for grades and to plant malware to steal credentials.
Three: Unless the school's computers are really old, there won't be a vulnerability that you can use.
Four: Don't change your own grades. You'd really have to be an idiot to think that no one would notice. The movie War Games is nothing like real hacking today.
Five: The only way that you're likely to succeed is to put in the years of work that it will take to learn.

Number one: you’re dead wrong. It’s not as hard as you think.

Two: Sure, reconnaissance is essential, but you’re missing the point. If you’re already on the student network, you’ve got a foot in the door to the IT/Admin network. There are always ways to exploit (Human) vulnerabilities and idiocy even in seemingly secure systems.

Three: I get what you’re saying about vulnerabilities, but as said the security is ass and they still run on windows 10 and barely do any updates

Four: I know Changing your own grades can be risky, but it’s definitely possible. I’ve seen it happen, someone did it, and now they’re studying successfully. It’s about being smart and subtle

Five: you don’t have to start from scratch. If you understand the basics of the system and its vulnerabilities, you can make progress without dedicating years to it. You just need the right approach and a bit of creativity.

[SilentNuke]

I’m not really that familiar with the German system either( i will be in a few days), but from what I’ve gathered, the grading is heavily based on LUSD, which is the centralized school management solution for schools in Hessen(the state). This system manages all kinds of student data, including grades and teacher assignments and even graduation levels. Teachers have their own access credentials, and if someone managed to get a hold of those, they could easily manipulate grades(Like i know how some guy didnt look away when his teacher typed in his password and he changed his grade in Maths from an E to a B+ and cause of that he was able to graduate)

I know what I’m suggesting is illegal, and it typically has a three-year statute of limitations before it expires. But im really looking to explore this, i'd need to dig deeper into the specifics of the LUSD system and how the access controls are set up. Getting familiar with how the teachers manage their data and what vulnerabilities exist in their logins could be key. i would just need to know where to start with the basics of that so i can have a grasp on how to start

could be as easy to just steal the passwords ik, but its riskier to do that i think.

---

Install a keylogger that writes to a remote document so you don’t have to access that computer constantly to get the data.

[q4ssam]

Install a keylogger that writes to a remote document so you don’t have to access that computer constantly to get the data.

Hm, Thanks for the Idea