"Reverse Engineering" client application in an educational center

Hi, Habr. I want to share a story from life experience. A few months ago, I signed up for paid courses in the programming language JavaScript in the beautiful city of Minsk. I spent about a week of time studying the reviews of each of the companies on the market in detail, comparing prices for services and location relative to my house. Finally, choosing a “worthy” candidate, I went to their office to conclude an agreement. In general, I passed the initial briefing, received the schedule of classes and the content of the entire course, and gladly got down to business.

The course was quite good, the teachers had real experience in developing production projects and tried very hard to explain as simply as possible various aspects of the language, but this is not the story about that ...

At the end of two months of classes with a frequency of 4 days a week for 4 hours, each student had to pass a control test in the form of 80 questions in the subject with many answers. The company promised, on the condition of successful testing, to help find a job in a large company in our city for the position JavaScript Developer. Very tempting.

Here is an example question:

1. What will console.log () show?

(function() { var x = 1; function x() {}; console.log(x); })(); 

And several answer options, designed like this:
')


In the figure, black squares are checkboxes . The answers to all 80 questions can be from 1 to all that is in the list of options.

I, as a diligent student, immediately rushed to answer them. However, having stopped on question 3-4, I wanted to find out how this system works. Scrolling to the bottom of the page, I pressed the “Done” button and saw the following: all the questions that were answered incorrectly - all those left without my answers - became highlighted in red. A beautiful frame appeared and the background-color of the parent of the question element changed. “Oh, validation!”, I thought, and began to find out how it works.

In general, I opened FireBug, updated the page and pressed the “Done” button again. I saw that the request to the server did not go, that is, the validation client-specific is currently running. Then I opened a list of JavaScript files that are connected to the page (by the way, Backbone + RequireJS was used there ), and found a module called “validation.js” .

At first I went to unminify.com , I needed to bring the code back to normal. After reading the code, I found the “validate” method with the following content:

 /*      */ $(".questions").each(function(i,e){ var a = []; $(e).find(":checkbox").each(function(index,elem){ if($(elem).val() % 31 == 0) { /* ,    */ } else { /* ,  */ a.push(index); } }); if (!a.length) { /*     ,   correctAnswer();*/ } else { /*     ,   wrongAnswer();*/ } }); 

Next, I looked at the html markup of all checkboxes:

 <input class="ui-element-checkbox" type="checkbox" name="answer" value="2561"> 

So, a remarkable number in the attribute “value” was the key to the correct answers of the test. It is not difficult to guess that the request to the server will be executed only if only the correct answers are selected.

I wrote a small script that went over all questions, found checkbox elements in each specific question, took their value and divided it into 31; if the balance is 0, set the 'checked' attribute to true ; if not, go ahead:

 var parent = $(".questionnaire-text"); var answers = parent.find(".answers[data-type='checkboxes']"); answers.each(function(index,elem){ var checkboxes = $(elem).find(":checkbox"); checkboxes.each(function(i,e){ if ($(e).val() % 31 === 0) { $(e).attr("checked","checked"); } }); }); 

After a moment, I saw all the correct answers to absolutely all 80 questions in the test. I gladly pressed the “Done” button and, oh, a miracle — in FireBug I saw a sent request to a remote server of the training center, to which I received an answer congratulating the successful passing of the test by 100%.

Naturally, I did not want to be caught in fraud during the test, so I sat for another 20-25 minutes quietly at the computer before telling the curator about the readiness.

I must say, no one except me is 100% passed this test. In total, only 3 people, including me, passed the test positively for more than 75%. The rest of the guys did not score and 50% of the correct answers.

After successfully completing the courses, I was interviewed at one of the companies in Minsk for the position of JavaScript Developer, but the thought of that trick during the test gave me no rest. One day I came to that very training center and told them everything. They expressed gratitude for my honesty and gave me a volleyball ball.

Here is a story. I want to advise everyone not to be afraid of exploring unknown areas and constantly finding easy ways to solve difficult problems. Thanks for attention.

PS The given code examples only partially describe the real functionality. Also, the story is not my personal, but my very good friend, who asked me to stay incognito.