Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

LAN-based exam system with fingerprint popup (192.168.14.5) — how does it work and how could it be bypassed? : hacking | Torhoo darknet markets

Target: University exam system hosted at 192.168.14.5 (accessible only via campus Wi-Fi).

How it works:
- When accessing the site, a native popup appears asking for a fingerprint scan via a connected device.
- After scanning the finger successfully, the popup closes.
- Then the exam interface loads in the browser.
- It seems the authentication is handled locally — likely through JavaScript interaction with a DLL or COM object.

Question:
Has anyone dealt with this type of local biometric authentication before?
How is this usually implemented, and what are the possible ways to understand, analyze, or bypass it?

Strictly for research purposes.

/u/femboy_destroyer69 P

1 points

1 month ago

view page source

/u/cilantr0

1 points

1 month ago

If you have enough permissions to install software in the client computer, you may give it a try to load zed attack proxy, from OWASP, to capture and analyze all the HTTP/S traffic when connecting, and see if you may modify or tinker with the GET/POST requests exchanged between your computer and the server. Good luck with it.

/u/Foo9eeng

1 points

1 month ago

sniff the traffic, likely encrypted and futile effort, fyi

/u/flosky21

1 points

1 month ago

[removed]

/u/TenThousandEyes

1 points

1 month ago

Yes im sure a student at a university can afford $650,000 spyware to put it on a students phone.

Since its on the LAN, its likely not encrypted. Open up wireshark and watch it when you authenticate. Since its over wifi, you may be able to see other student's fingerprint data as well and may be able to use something like burpsuite to send someone else's fingerprint instead.

/u/ringct

1 points

1 month ago

Study and pass the exam.

Sponsors