How I Lost 22,000 Points Breaking Into My Instructor's Website

In my junior year of high school I took the intro to cybersecurity class. The instructor was someone I’d enjoyed working with before. The first stretch was readings, slides and small labs on virtual machines.

Then we got split into groups by the tables we sat at. Every other week each group made a presentation loosely related to that week’s classwork. (They were really silly.)

Around then the instructor added a point system to the class website, Harry Potter style. You earned points for participation, answering questions and going above and beyond in your interest in cybersecurity. You lost them for misbehaving or being unproductive.

My team led by a few points, but a presentation was coming up that would probably ruin our numbers. (Humor was our strong suit.) I had the genius idea of a point heist: hack into the instructor’s website and change the numbers myself.

I knew it ran on WordPress, because we’d built portfolio websites on that domain in an earlier class. A little research turned up a query you could tack on to reveal the administrator username. The password was a bit of luck, to be honest. The basic ones didn’t work, and I was stuck.

I talked it over with some friends, and one of them had worked on a project with this instructor and been given a password for it. In the very next class, not paying attention to anything going on, I tried the login. Instantly I was looking at the admin dashboard: plugins, pages, posts, users. I was in disbelief.

What I did next mattered. First I added 20,000 points to my team’s ledger (we had 2,000). Then I added a smiley face emoji to the homepage. I wanted it noticed, but not enough to get in real trouble.

Then the last step. The site had plenty of plugins and theme files, so I could hide a block of code in their PHP. From my brief research I’d found a snippet that creates an administrator user through a webhook. I felt unstoppable.

The next few days were amusing. The instructor spotted the point discrepancy right away and pointed the blame at me. (He had known what I was up to, he just didn’t think I’d pull it off.) As a reward, my team got 500 points, with a 22,000 point penalty on top. We were back at about zero.

Which meant we had nothing to lose. After every class I used the webhook backdoor to sneak my account back onto the site and leave a message like “I’m in your walls,” so the instructor knew I was still in after the password change and the account deletion.

He didn’t find out about the backdoor until a week later, when I laid the whole story out start to finish. By then I couldn’t get in anyway. The site would only accept logins from the instructor’s home network, and I was NOT going to drive over there and breach it for this.