Your System is Weak 🫣

MRCM Institutional Portal Vulnerability & Directory Audit

Bro 😭💀 I only had 45 minutes to do all this and somehow managed to dig through the database and understand the whole platform 💀😂 And the security holes are HUGE 😭🔓 Like bro… seriously? 😂💀 The school needs to take this seriously because there are legal and privacy obligations too 🤡📚 At this point, the records are basically sitting there like 👀💀 Think bro… THINK 😭😂

2,004

Student Records

Classes, Admissions & Passwords

133

Faculty & Staff

Teaching & Department Profiles

Audit Points

Bilingual Technical Analysis

PIN: Hack For It 😉

Zero-Trust Vault

NIC & Birth Certificate Guard

Explore Database Directory 18-Pt Technical Audit

🚫

Client-Side Auth Illusion

Hiding DOM rows with CSS or JavaScript does not protect data. All records arrive in browser memory unauthenticated.

🔐

Zero-Trust Identity Guard

Student Birth Certificate and NIC numbers are strictly masked until verified with cryptographic PIN Protected [Hack For It 😉].

📜

Bilingual Educational Review

18 comprehensive vulnerability breakdowns written in English and Sinhala with architectural remediation steps.

⚡

Zero-Server Dependency

Engineered to work reliably over HTTP servers or directly via file:/// protocol with automated file pickers.

HIGH PRIORITY DIRECTIVE • EXECUTIVE NOTICE

⚠️ School එකට වැදගත් Note එකක්

🔐 Website Security ගැන විතරක් නෙවෙයි — Teacher Personal Data සහ PDPA Law 2022 ගැන සම්පූර්ණ විග්‍රහය Popup එකෙන් කියවන්න.

Developer Security Advisory • Educational Audit Notice

This demonstration highlights critical architectural flaws in the institutional portal. Authentication was handled in client memory, exposing sensitive identity records without server session verification.

Developer Note: "This security vulnerability was uncovered and documented by a developer. These vulnerabilities (leaking plain text passwords in browser memory and client-side access control) are elementary 'kids' stuff' mistakes in web architecture. The administration must urgently discard this obsolete codebase and upgrade to a brand-new, modern, server-secured institutional portal."

🔴 High Risk: Memory Leakage 🔐 PIN Protected: HACK FOR IT 🛡️ Strict Defense Mode

Showing 0 of 0 records

↔ Swipe horizontally to view all database columns

ETHICAL CYBERSECURITY RESEARCH 🔐 PIN: Hack For It 😉

🔐 MRCM Web Security Review

“Security තියෙනවා වගේ පේනවා… ඒත් ඇතුළට ගියාම story එක වෙනස්” 💀

⚠️ Disclaimer: This is an informational security-awareness review based on security-related behavior visible from the frontend. It does not claim that private databases, student records, or backend systems have been compromised.

🕵️ Introduction

Website එකක් open කරද්දි අපිට සාමාන්යයෙන් පේන්නේ login screen එකක්. Username එකක් තියෙනවා. Password එකක් තියෙනවා. Login button එකක් තියෙනවා. Maybe loading animation එකකුත් තියෙනවා. 😭

ඒක දැක්කාම සාමාන්ය user කෙනෙක්ට හිතෙන්න පුළුවන්: “Ado, මේක නම් secure website එකක්.” 🔐

But security engineering එකේදී, what the website looks like සහ how the website actually enforces authorization කියන්නේ completely different things.

කොටින්ම: Lock එකක් තියෙනවා කියලා building එක secure කියලා automatically කියන්න බෑ. 😂

මේ review එකේ interesting part එක තමයි, frontend code එක බලද්දි security ගැන හිතලා තියෙන බව පේනවා. But some of those security mechanisms are happening in places where the user's own browser is in control. And that's where things become… interesting. 👀💀

🔐 01. The Legendary Login Screen

Very serious. Very professional. Very government-secret-lab vibes. 😭

But a login screen by itself isn't security. It's just a UI.

Frontend එකෙන් “Are you authorized?” වගේ question එකක් අහලා, browser එකෙන් ලැබෙන answer එක blindly trust කරන architecture එකක් නම්… browser එක security guard කෙනෙක් නෙවෙයි. 😂

Browser එක basically userගේ machine එකේ තියෙන software එක. ඒ නිසා: Frontend = presentation + client-side logic සහ Backend authorization = actual enforcement boundary කියන difference එක critical.

සිංහලෙන් කියනවා නම්: “දොරේ ‘Authorized Personnel Only’ කියලා board එකක් ගැහුවා කියලා ඇතුළේ security guard කෙනෙක් ඉන්නවා කියලා හිතන්න එපා.” 😭🔐

💀 02. Client-Side Security: “Trust Me Bro”

මෙතන තමයි funniest part එක. Application එකේ access state එක browser-side mechanisms එක්ක heavily connected නම්, website එකේ security decision එකේ කොටසක් client side එකට shift වෙනවා.

ඒ කියන්නේ website එක essentially browser එකට කියනවා: “Bro, මේ user authorized ද කියලා ඔයා remember කරගෙන ඉන්න.” 🥺

Browser: “Sure bro 👍”

Security engineering: “Wait… WHAT?” 💀

Client-side state is useful for UI behavior. But using browser-controlled state as the ultimate source of truth for authorization gives the whole thing a very questionable vibe. It's like hiring the person trying to enter the building as the security guard. 😂🔐

🗃️ 03. Local Storage: The Tiny Security Vault™ 😭

Modern websites love browser storage: LocalStorage, SessionStorage, Cookies, IndexedDB. Everything is useful for different purposes. But there's a huge difference between:

“Remember this UI preference.”
“This proves this person is authorized.”

Those are NOT the same thing. If an application treats a browser-side value as the reason someone is allowed to see protected content, that's a very interesting architectural choice. Because the browser belongs to the user. Not the server. Not the school. Not the database. The user. 😭

So when the browser says “Yep, I'm authorized,” the server shouldn't just respond “Ah okay, welcome back sir.” 🫡 That's basically: Security by trust-me-bro™.

🥷 04. “Don't Press F12” Security & “Right Click Disabled”

Now we reach one of my favorite parts. The website tries to prevent things like: F12, Right click, certain keyboard shortcuts, browser inspection shortcuts. And honestly… The effort is impressive. 😂 But the concept is hilarious when treated as a security boundary.

Because: Disabling F12 ≠ securing the application. It's like putting a sign on a safe saying: 🚫 PLEASE DON'T LOOK INSIDE and then calling it bank-grade security. 😭

Website: ❌ Right click disabled. → Browser: Okay. → Security researcher: Interesting. 👀

Right-click blocking mostly affects convenience. It doesn't create a cryptographic wall around the application. It doesn't turn JavaScript into an impenetrable fortress. It's basically the web equivalent of: “Ane please inspect කරන්න එපා 🥺🙏” 😂😂😂

🧠 05 & 06. JavaScript Is Not Secret & Public Secrets

One of the biggest misunderstandings in web security is thinking: “Users can't see the code, so the code is secure.” Except the browser literally needs the code. If JavaScript is sent to the browser, the browser has to receive it. And if the browser can execute it… well… it's not exactly a secret anymore. 😭

Imagine writing: const secret = "very_secret_value"; and then sending that JavaScript file to every visitor. Technically: “It's a secret.” Practically: “It's a secret that we delivered directly to the visitor.” 💀

Sinhala version: “රහසක් කියලා browser එකටම දීලා, browser එකෙන් ඒක හංගගෙන ඉන්න කියන එක ටිකක් funny නේද?” 😭

🎭 07 & 08. Login Screen ≠ Auth System & The “Authorized” Sticker

A login page is an interface. Authentication is a security process. Authorization is a permission decision. Those three things aren't identical.

You can have a beautiful login screen with animations, loading spinners, fancy icons, SweetAlert popups, dark mode, dramatic transitions… and still have weak authorization underneath. Basically: UI: 🔐💎🏰 | Security architecture: 🪑💀

Imagine walking into a school office. Security guard: “Are you authorized?” → Person: “Yes.” → Guard: “Proof?” → Person: “I have this sticker: 🟢 AUTHORIZED.” → Guard: “Okay bro, come in.” 😭 That's roughly the kind of trust model you don't want to rely on for serious authorization decisions. Because the person carrying the sticker also controls the sticker. 😂

🧱 09 & 10. Frontend ≠ Security Boundary & Iframe Security

Frontend code is visible to the client. Frontend state is controlled by the client. Frontend UI can be modified by the client. Frontend behavior can be observed by the client. Therefore:

“Frontend controls should not be confused with backend authorization.”

You can hide an element. You can show a login popup. You can display: 🚫 ACCESS DENIED. But none of those things alone prove that the underlying data is protected.

Sinhala-English version: “Button එක hide කරලා database එක secure වෙන්නේ නෑ machan.” 😭🔐

Also, putting something inside <iframe> doesn't suddenly transform it into: 🛡️ Military Grade Secure Container 3000™. An iframe is still part of the browser environment.

🚨 11, 12 & 13. Error Handling, Hidden vs Protected & Security by CSS 💀

If an authentication UI encounters an unexpected error and falls back to making the protected interface available anyway: Login system: “Something went wrong.” → Application: “Anyway… welcome.” 😭 That makes any security reviewer slowly put down their coffee and say: “Hmm.” ☕👁️👄👁️

Hiding a dashboard with CSS (display: none;) means: “The user shouldn't see this right now.” Actual authorization means: “This user is not allowed to access the protected resource.”

Sinhala: “Screen eka hide කරලා තියෙන එකයි, data eka protect කරලා තියෙන එකයි දෙකක්.” Basically: “කඩේ shutter එක ඇතුළෙන් lock කරලා නෑ… curtain එක දාලා තියෙන්නේ.” 😂

🧑💻 14, 15 & 16. DevTools, Obfuscation & Where Is the Trust?

DevTools isn't some evil hacking machine. It's literally a standard browser feature used by developers, QA testers, and researchers. Trying to prevent inspection doesn't make an application secure.

Confusing code ≠ secure code. Hidden UI ≠ protected resource. Disabled shortcuts ≠ authorization. Browser state ≠ trusted identity.

Every authentication system eventually has to answer one question: Who decides whether this user is allowed to access the resource? If the answer is mostly: “The browser decides,” that's where the architectural breakdown occurs.

🕵️ 17 & 18. What This Review Does NOT Claim & Overall Vibe

This review does not prove: ❌ That the database has been breached. ❌ That student records have been accessed. ❌ That private information has been leaked. ❌ That the backend is definitely vulnerable. What can be discussed is what the frontend architecture appears to expose.

🎬 Movie title: “Mission Impossible: Please Don't Press F12”

Main character: 🔐 Login screen
Supporting character: 💾 LocalStorage
Comic relief: 🚫 Right-click disabled
Villain: 🧑💻 Developer Tools
Ending: “Wait… who is actually enforcing the authorization?” 👁️👄👁️ 💀💀💀

🇱🇰 Sinhala Translation of the Entire Situation

සරලවම කිව්වොත්: Website එකේ security කියලා පේන්න mechanisms ගොඩක් තියෙනවා. Login screen එක තියෙනවා, Access checks තියෙනවා, Browser storage තියෙනවා, DevTools block කරනවා, Right-click block කරනවා, Dashboard එක hide/show කරනවා, Iframe use කරනවා. ඒක දැක්කාම “අඩෝ මේක නම් NASA level security එකක්” වගේ පේන්න පුළුවන්. හැබැයි web security වලදී ප්රශ්නය: “Protected resource එක access කරන්න ඇත්තටම authorization එක enforce වෙන්නේ කොහෙද?” කියන එක.

Page එක hide කරන්න පුළුවන්. Button එක hide කරන්න පුළුවන්. Right-click block කරන්න පුළුවන්. F12 block කරන්න පුළුවන්. Login popup එක දාන්න පුළුවන්. හැබැයි ඒවා security boundary එකක් කියලා automatically කියන්න බෑ. ඒක තමයි මේ whole review එකේ main point එක. 🔐

🏁 Final Verdict & Rating

🏰 Fort Knox on the outside • 🎨 Web app on the inside • 🥺 “Please don't inspect” energy everywhere • 💀 Browser being trusted a little too much

Security awareness takeaway: “Never confuse a security-looking interface with a security boundary. Frontend can say ‘NO.’ Actual authorization has to mean ‘NO.’” 🔐

Anyone can ignore a person,
but no one can replace the value of their skills.

-AnymousMRCM

• Developer & Security Researcher

✅ Action completed successfully