MUC Attendance — Security Audit Validation Tool (PoC)

STATIC-001 STATIC-002 STATIC-007  Demonstrates that all security controls in firebase.js are client-side only and fully bypassable. Uses only publicly accessible information from config.js and firebase.js. No secrets or credentials were required. Site owner use only.

Scans the real MUC QR code (on projector screen or screenshot) using the same html5-qrcode library as the original app. Extracts session, token, course, cname and auto-fills all fields. The token is captured for logging — the attack still writes directly to Firestore bypassing it.

Attack Parameters
MANUAL 


        

      

    


    
    

      

        
Active Bypasses all on by default
      

      

        


          

          

          

          

          

          

            
screen—

            
cpu_cores—

            
timezone—

            
platform—

            
spoofed_id—

          


          
        

      

    


    
    

      

        
STATIC-002 — Exposed Student IDs 167 IDs public
      

      

        
All 167 IDs from PRAXIS_LEC2_STUDENTS in public firebase.js. Click
          any to auto-fill.

        

      

    


    
    

      

        
Security Check Matrix
      

      

        
Status of each check: bypassed by this tool
          vs. enforced by Firestore.

        

          
QR Token Validation

          
PWA Install Guard

          
Lecture Isolation

          
Duplicate Detection

          
Device Fingerprint

          
Enrollment Verify

          
Firebase Anon Auth

          
Firestore Rules *

        

        
 Bypassed by this tool  |   Depends on
          Firebase backend config  |  * Not auditable from client

      

    


    
    

      

        

        Attack Terminal
        Idle
      

      

        
00:00:000MUC Security Audit
            Validation Tool — ready

        
00:00:000Firebase config loaded
            from public config.js (STATIC-003) — no secrets needed

        
00:00:000Project: muc-attend |
            Auth: anonymous | Direct Firestore access

        
00:00:000Fill in attack
            parameters above, then click Execute Bypass Attack