This Part 3 and finale of the tale of Mr DDTW, or the worst coworker I've ever had to deal with. I suggest you start from the beginning if you don't have the context, it's been a trip.
Part 1: https://devrant.com/rants/4210605
Part 2: https://devrant.com/rants/4220715

The problem with this man threatening to snitch on me to the professor if I didn't revert my commit was that he backed me into a corner. Letting him go at his pace with his quality standards would have ruined the project for the rest of us, and I'm not going to let three other people's grades suffer because one was lazy. I'm the PM, team lead, the guy who will ultimately be held responsible for this project succeeding or failing and the mediator of problems.

So I snitched first.

The professor knew us. He had an idea of how we worked as a team, who was enthusiastic about this subject, who was diligent, and who wasn't. It'd been half a semester and he wasn't stupid. I'd also taken the not-so-minor task of testing our software and handling all the little integration problems between components and between the professor's server. This had resulted in several calls between me and him because he'd been flying by the seat of his pants with some of the upgrades he'd been doing to the server code and as the fastest group we were the ones running into all the bugs on his end. And he'd also noted our prior complaint and seen the discrepancy in commits, author tags and hours logged. Mr DDTW had been graded significantly worse than the rest of us. So when I sent him a goddamn novel about our team's internal problems, the bomb was set. And so we get to the conference call, with everybody panicking and with no clue what any of this is about. Except me.

Dear god. That call was pure catharsis. Never have I seen a man get demolished so hard. Mr DDTW got a 45 minute LECTURE, a goddamn SMACKDOWN, about how he needs to take some responsibility for this team effort and that in the real world he'd have been fired. And the professor was so incredibly serene throughout! He could've blasted him with the rage of a thousand suns but he said it in such a way that Mr DDTW's only real responses were "yes", "I understand" and "I'm sorry". An entire semester of this useless fucking bitch being nothing but a leech on our team in three separate projects and he was finally getting SCHOOLED. And then, it gets even better. The professor asked how we could solve this problem, as Mr DDTW needs to do work to be graded but he can't hold us back.

I dropped a suggestion: As I had implemented the module in a way that worked, we could carry on using my version while Mr DDTW could work on a separate branch. Everything else was working reasonably well for an MVP, we just needed to improve and test now, so if Mr DDTW got it working we could merge it back into the main branch. This solved the team's problem of not being able to progress, it solved Mr DDTWs problem of not wanting to fail the course, and it solved my problem of not having to work with this shit-for-brains for the forseeable future. A weight was lifted off my shoulders. No more Mr DDTW. No more bitching and no more shitcode. A grating arsehole that had been bugging everyone all sememster put in his place and out of my hair.

On the way home from uni that day, I rang a friend and told him the entire story as I needed to get it off my chest. Every time I brought up a problem, an issue, a setback, an argument, he made a remark.

"Damn, if only he just... did the work."

Every time he said it it was in a slightly different way, but every time it made me laugh harder as he just didn't stop interrupting me with the same comment. If only he did the work. But the funniest part of all was how right he was. Mr DDTW had so many opportunities to just sit down, shut up, and do the work like the rest of us, but instead he decided to do fuck-all until he got flak for it and proceeded to dig his own grave. What sort of delusional entitlement, sheer incompetence or other dumbfuckery was he suffering from to make such terrible decisions? It's his last year of university and he still hadn't learned to just do the goddamn work (I would later find out that his friend had covered his shortcomings a lot and was apparently the reason why he hadn't flunked out of uni yet).

And so ends the story of Mr Didn't Do The Work the worst person I have ever had the displeasure of working with. We never did merge his branch as we ran out of time during testing. The professor passed him, possibly out of pity or just so that he wouldn't have to resit the course and burden some other poor sods. We weren't the top scorers this time, partially because of my shortcomings as PM but mostly because of the huge delays and manpower deficit, but we did well enough to pass the course with some very high grades. With one exception of course.

just found out a vulnerability in the website of the 3rd best high school in my country.

TL;DR: they had burried in some folders a c99 shell.

i am a begginer html/sql/php guy and really was looking into learning a bit here and there about them because i really like problem solving and found out ctfs mainly focus on this part of programming. i am a c++ programmer which does school contest like programming problems and i really enjoy them.

now back on topic.

with this urge to learn more web programming i said to myself what other method to learn better than real life sites! so i did just that. i first checked my school site. right click. inspect element. it seemed the site was made with wordpress. after looking more into the html code for the site i concluded all the images and files i could see on the site were from a folder on the server named 'wp-content/uploads'. i checked the folder. and here it got interesting. i did a get request on the site. saw the details. then i checked the site. bingo! there are 3 folders named '2017', '2018', '2019'. i said to myself: 'i am god.'
i could literally see all the announcements they have made from 2017-2019. and they were organised by month!!! my curiosity to see everything got me to the final destination.

with this adrenaline i thought about another site. in my city i have the 3rd most acclaimed high school in the country. what about checking their security?

so i typed the web address. looked around. again, right click, inspect element and looked around the source code. this time i was more lucky. this site is handmade!!! i was soooo happy because with my school's site i was restricted with what they have made with wordpress and i don't have much experience with it.

amd so i began looking what request the site made for the logos and other links. it seemed all the other links on the site were with this format: www.site.com/index.php?home. and i was very confused and still am. is this referencing some part of the site in the index.php file? is the whole site written inside the index.php file and with the question mark you just get to a part of the site? i don't really get it.

so nothing interesting inside the networking tab, just some stylesheets for the site's design i guess. i switched to the debugger tab and holy moly!! yes, it had that tree structure. very familiar. just like a project inside codeblocks or something familiar with it. and then it clicked me. there was the index.php file! and there was another folder from which i've seen nothing from the network tab. i finally got a lead!! i returned in the network tab, did a request to see the spgm folder and boooom a site appeared and i saw some files and folders from 2016. there was a spgm.js file and a spgm.php file. there was a contrib, flavors, gal and lang folders. then it once again clicked me! the lang folder was las updated this year in february. so i checked the folder and there were some files named lang with the extension named after their language and these files were last updated in 2016 so i left them alone. but there was this little snitch, this little 650K file named after the name of the school's site with the extension '.php' aaaaand it was last modified this year!!!! i was so excited! i thought i found a secret and different design of the site or something completely else! i clicked it and at first i was scared there was this black/red theme going on my screen and something was a little odd. there were no school announcements or event, nononoooo. this was still a tree structured view. at the top of the site it's written '!c99Shell v. 1.0...'

this was a big nono. i saw i could acces all kinds of folders. then i switched to the normal school website and tried to access a folder i have seen named userfiles and got a 403 forbidden error. wopsie. i then switched to the c99 shell website and tried to access the userfiles folder and my boy showed all of its contents. it was nakeeed naked. like very naked. and in the userfiles folder there were all, but i mean ALL files and folders they have on the server. there were a file with the salary of each job available in the school. some announcements. there was a list with all the students which failed classes. there were folders for contests they held. it was an absolute mess and i couldn't believe it.

i stopped and looked at the monitor. what have i done? just to learn some web programming i just leaked the server of the 3rd most famous high school in my country. image a black hat which would have seriously caused more damage. currently i am writing an email to the school to updrage their security because it is reaaaaly bad.

and the journy didn't end here. i 'hacked' the site 2 days ago and just now i thought about writing an email to the school. after i found i could access the WHOLE server i searched for the real attacker so if you want to knkw how this one went let me know in the comments.
sorry for the long post, but couldn't held it anymore