2 hours ago
[DUMP] SMK Negeri 1 Luragung (Indonesia) - Full Student Database, Grades, Attendance & Admin Access
Greetings, BreachForums.
Long time lurker, first-time poster. Today, I'm sharing a recent project I finished targeting the infrastructure of SMK Negeri 1 Luragung, a vocational high school in Indonesia.
The whole infrastructure is a mess of misconfigurations, and I managed to pull the entire student database, academic records, and admin API access without much effort.
Target Infrastructure:
- dashboard.smkn1luragung.sch.id (Laravel 12 - Main Dashboard)
- ujian.smkn1luragung.sch.id (PHP Native - Exam System)
- adm.smkn1luragung.sch.id (Vue.js SPA + JWT - Teacher Administration)
How I did it:
1. Laravel Debug Mode Exposed: The main dashboard had APP_DEBUG=true. A simple malformed request to /password/reset threw a full stack trace, revealing the backend framework (Laravel 12) and the internal structure.
2. PHP Native Routing & LFI: The exam system used ?page= routing without proper sanitization. While they had basic whitelisting, the lack of security headers and exposed endpoints made it a walk in the park.
3. Weak Admin Credentials: The Teacher Administration panel (adm.) was using the default credentials: admin:admin123.
4. JWT Token Extraction: Once logged into the adm. panel, I extracted the JWT token and bypassed the frontend entirely. The backend API (/api/siswa, /api/nilai, /api/absensi) didn't have rate limiting or IP blocking.
What's in the dump?
I wrote a custom script to pull the entire database via the exposed REST API. Here is the breakdown:
- 47 KB of complete student data (siswa.json): NIS, NISN, Full Name, Gender, Class ID, Major ID.
- 20 Files of Academic Grades (nilai): Every student's score for every subject and class.
- 5 Files of Attendance Records (absensi): Full attendance logs for October 23, 2026.
- Master Data: Classes (kelas.json), Majors (jurusan.json), and Subjects (mapel.json).
Proof of Concept:
Here's a small sample from the siswa.json (Student Data) dump:
{"success":true,"data":[{"id":75,"nis":"251271021071","nisn":"20254692","nama_lengkap":"ABIN SABINA","jenis_kelamin":"L","kelas_id":6,"jurusan_id":6,"created_at":"2026-08-02T15:18:17.000Z","nama_kelas":"XI DKV 3","tingkat":"XI","nama_jurusan":"IZINN","kode_jurusan":"#SMKN 4 KNG"},{"id":76,"nis":"251271021072","nisn":"20254692","nama_lengkap":"ADELIA AGUSTINA","jenis_kelamin":"P","kelas_id":6,"jurusan_id":6,"created_at":"2026-08-02T15:18:17.000Z","nama_kelas":"XI DKV 3","tingkat":"XI","nama_jurusan":"IZINN","kode_jurusan":"#SMKN 4 KNG"}]}
Download Link:
For those who want to check the full database dump themselves, I've uploaded the ZIP file containing all the JSON files (student data, grades, attendance, master data) for free.
Notes & Conclusion:
This school runs the data of hundreds of students and teachers. The fact that the admin password was literally admin123 and the API was left wide open is a joke.
They have been notified (internally, by their own system logs), but I doubt they even know how to check them.
Happy hunting.