4 ms·

Thats just ViewState (throw it in http://viewstatedecoder.azurewebsites.net/ http://viewstatedecoder.azurewebsites.net/ if curious) of the schools array. Nothin

by spydum 5y ago

Thats just ViewState (throw it in http://viewstatedecoder.azurewebsites.net/ http://viewstatedecoder.azurewebsites.net/ if curious) of the schools array. Nothing special on the page. I suspect whats suspect is the lookup portion on the server side.

mikeyouse 5y ago
Based on the description in the original article: > Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. And the layout of that site - I suspect when you clicked through to look at a teacher, it would display the Name + last 4 of their social security number with their teaching credentials. I suspect that if you viewed source on that page, the full SSN was in the retrieved data but the page was just displaying the last 4 digits. Can't confirm without the Archive site actually pulling live data but it seems to line up.
- flatiron 5y ago
  what they prolly meant is reporter went to the debugger network tab and saw the JSON response which had the full social returned. "HTML source code" is lingo for "I have no idea whats going on"
  - jeroenhd 5y ago
    From the looks of the page I doubt the output was anything as fancy as JSON. This looks like a classic pre-rendered page from the early 00s, made by the nephew of the CEO or equivalent. I'm actually surprised there's JS running on these pages at all. There's a bunch of <input type="hidden"> elements in the search page, so I guess they did something similar to hide the information from their `select *` that wasn't meant for public consumption. Edit: looking at the code (directly referencing XMLHttpRequest etc.) it might also be raw HTML being injected into a table somewhere... Edit 2: based on the "base64" comments, I'm guessing the "view state" (ASP term?) was not encrypted and contained some secret info. There are other systems from other states running on similar tech, but they seem to encrypt their viewstates...

by spydum 5y ago

mikeyouse 5y ago

Based on the description in the original article: > Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. And the layout of that site - I suspect when you clicked through to look at a teacher, it would display the Name + last 4 of their social security number with their teaching credentials. I suspect that if you viewed source on that page, the full SSN was in the retrieved data but the page was just displaying the last 4 digits. Can't confirm without the Archive site actually pulling live data but it seems to line up.

flatiron 5y ago
what they prolly meant is reporter went to the debugger network tab and saw the JSON response which had the full social returned. "HTML source code" is lingo for "I have no idea whats going on"
- jeroenhd 5y ago
  From the looks of the page I doubt the output was anything as fancy as JSON. This looks like a classic pre-rendered page from the early 00s, made by the nephew of the CEO or equivalent. I'm actually surprised there's JS running on these pages at all. There's a bunch of <input type="hidden"> elements in the search page, so I guess they did something similar to hide the information from their `select *` that wasn't meant for public consumption. Edit: looking at the code (directly referencing XMLHttpRequest etc.) it might also be raw HTML being injected into a table somewhere... Edit 2: based on the "base64" comments, I'm guessing the "view state" (ASP term?) was not encrypted and contained some secret info. There are other systems from other states running on similar tech, but they seem to encrypt their viewstates...