Boat Licenses
NOTE: June 17th 2016 - I received a cease and desist letter from boat-ed.com and they have fixed the way in which the script in this post circumvents the wait. I am not aware of any other way to bypass it.
Summer is fast approaching and me and a group of friends decided to take the water on some ridiculously fun jet skis. In the state of Washington, a boat license is required to operate any PWC (personal watercraft) which thankfully can be done online. As a procrastinator I put aside 30 minutes of my time the night before the excursion to do the online exam on www.boat-ed.com. I was in for a large shock when I discovered that you had to sit through all the course material on the website prior to attempting the exam; average time for completion 6-8 hours.
Time is precious
Time is precious. It's constantly fleeting and the last thing I wanted to do was sit through 6-8 hours of instructions that I knew and are largely common sense. The final exam should be indicative of whether you know the material or not, therefore it is not necessary to force people to sit through the course (all though you can Google the answers to the exam...). As my roomate decided to sit through the course material blindly hitting next when the button becomes available as he watched tv shows on Netflix, I decided to investigate if my knowledge of Computer Science can save me!
Chrome Extensions FTW
tl;dr; Install this Chrome Extension, which will enable you to skip any State Boat License course on www.boat-ed.com
Having some prior experience to writing Chrome Extensions and knowing more than my fair share of web services, I was able to dig into their JavaScript source files and find how they were forcing the users to sit through the course material. I will leave future blog posts perhaps detailing how one might go about "hacking" websites to reverse engineer their web services and fiddle around with it, briefly the steps were:
- Reverse obfuscate their JavaScript
- Find the offending timer code
- Figure out how to diable the timer (was a server call
- Fake the code in a Chrome Extension
42 archived comments
Mitchell Torres · 2013-12-22
lol genius, if i ever need a boat license i will definitely use
Priyankanaidu · 2014-07-06
Hello, my name is Darby. I’m a 7 year old weimaraner. I’m using this new cotupmer for the first time today as my mom, Monica got a virus on the old pc. There has been a lot of fussing going on as she usually uses a pc and this is a mac. I hope she figures it out soon or this could be a very long semester. This is Monica’s third semester. She took time off during the summer to go visit family in the lower 48 and enjoy the Alaska summer. We hiked almost every weekend. I got good at chasing foxes, but would turn around as soon as they barked at me. Due to government cut backs, Monica lost her job this week. She is now determined more than ever to finish the medical/dental receptionist program then continue to medical coding and billing. Her final goal is to become a geriatric nurse. Monica has an eight year old daughter that snuggles up to read to me every night. Dad is in the Air Force so we move a lot! Mom was so excited to find the online program at UAF so she can finish a degree no matter where we live. Well, it’s past my bed time and I’m sure someone’s feet needs me to lay on them. Good luck this semester and enjoy all the exciting stuff you get learn!!
Jens · 2014-09-08
I started out to do this then saw that you had already done the work, so thanks :)
I took your code and added one additional line which automatically clicks the “next” button, I just placed it in the success portion of the ajax call:
document.getElementsByClassName(“timer”)[1].click();
Farid Zakaria · 2014-09-11
Ahaha sweet!
Kyle Dacus · 2014-12-29
Hi,
I am trying to do this for hunter-ed.com which is ran by the same company? Can you help?
Thanks!
Farid Zakaria · 2015-01-02
hey send me an email and i can try to help.
Garrett · 2015-02-05
I’m trying to add in the auto next but I’m not exactly sure where to put it.
I did it like this:
$.ajax( { url:_url , data: _data, success: function() document.getElementsByClassName(timer)[1].click(); { console.log(“Successfully disabled wait.”); (document.body || document.head).appendChild(injectedScript); }, error: function(e, n) { console.log(“Error… Something is up…”); console.log(e); console.log(n); } });
But it keeps returning this error:
Uncaught SyntaxError: Unexpected identifier
The script works without me adding that line.
Garrett · 2015-02-05
Not sure why it didn’t carry over the quotes around timer, but I have it with quotes.
Farid Zakaria · 2015-02-17
Can’t really tell from here. Just set a breakpoint or run it on the console to check ? You are likely missing some syntax thing based on the message
Tom · 2015-04-07
I second the hunter-ed.com timer skip. A 3 minute timer to stare at the parts for a lever action rifle I’ll never use is enough to drive one insane.
Spencer · 2015-06-15
How do u download
SDC · 2015-06-26
Does this extension still work? I’m on an iPhone at the moment but will have my laptop available to me on Sunday.
matthew · 2015-07-10
so how can we make the boat ed automatically click next?
fzakaria · 2015-07-10
not sure. I haven’t used it in a while. I doubt they’ve changed their site though.
fzakaria · 2015-07-10
You need to download the zip file and install the extension.
fzakaria · 2015-07-10
Its probably doable but I already think a huge win was being able to even manually click next on it :)
motomatt77 · 2015-07-14
Any chance for this on the free test site boatus.org ?
fzakaria · 2015-07-14
You can probably leverage the code to work for it as well. I don’t have the bandwidth to investigate myself sorry;
MP · 2015-08-04
Trying to reach you Farid. How do I find your email?
fzakaria · 2015-08-04
Check my About page there should be a link there to my email.
bob · 2015-08-19
how do you do this? please help
JC · 2015-08-23
I just tried it on a mac and chromebook and it’s not working for me. So sad.. this test is unbearable.
fzakaria · 2015-09-08
I got a cease & desist letter so I’m likely going to remove it from the chrome store anyways :(
fzakaria · 2015-09-08
I got a cease & desist letter. They might have fixed the ability for it to work.
nrodgsxr · 2015-09-19
It doesn’t work anymore. Thanks for trying!
JB · 2016-02-07
How do u download the zip file?
Fractured · 2016-02-18
Can you help me with this here is my skype: farctured please add me and help
fzakaria · 2016-02-18
Sorry, I gave it a quick look earlier and don’t think there is anything I can do at the moment. I believe for now they’ve solved the exploit.
If i have time again in the future i’ll give another crack at it :)
Duff · 2016-04-15
If only you could see my face as I read go from ecstatic to dismay
Ryan · 2016-04-28
Lol I did the same thing. I was so happy reading until I saw that is no longer available :’(
fzakaria · 2016-05-02
yea sorry about that - was fun while it lasted (and before i got a threat from the company to sue me).
I think the statement of the post though was that it pays to always know a little programing so you can explore the javascript console of a web page. Who knows, what goodies you’ll find :)
Karel · 2016-06-04
Can you please update the extension, Is not working
Jordan · 2016-06-04
First time reader. Came across this as I was looking into ways of skipping the timer. Being in automation, I’ve been thinking how it’d be helpful to be able to automate the button clicking, but outright skipping is far better.
I would love to see your future post on what your process was for “hacking” the site.
Anyways great read!
fzakaria · 2016-06-04
I believe they fixed the hack. I might write a short piece on how to reverse engineer such hacks to empower others in their use of the web.
Jordan · 2016-06-06
That’d be awesome if you did! I noticed they patched the issue.
This is a GIANT pain in the ass to deal with(hence why i haven’t actually completed mine yet). Maybe tonight if i get some time i’ll start tryign to dig in and see if i can get around the timer BS crap
fzakaria · 2016-06-07
I think they never use to track the time on the server side and now they do which makes trying to bypass it much harder (although possibly still possible if there’s other bugs)
SARAH · 2016-06-17
I NEED HELP, IM TAKLING THE BOAT COURSE AND DO NOT WANT TO SIT THROUGH THIS
Brian Knudslien · 2017-02-19
where do you put it? How do you do it?
Jacob Bowser · 2017-05-06
Can you figure out who to get past it again? I will pay cash. Im trying to get my boating license before summer starts so I can take friends out on boat without parents. I have some programming experience but I was not able to find any holes or bugs. I will eventually ask some of the programmers at my school to help, but I am trying to finish by the end of this weekend. If possible, pleas help. I can paypal or Venmo you cash if you are able to get past it again.
Time Wasting Hater · 2018-06-13
For those finding this page only to be disappointed. Here is a workaround. Install below chrome extension, then add an entry under the option (right click the extension after installing and choose options) and add below entry.
Extension: https://chrome.google.com/webstore/detail/lauras-auto-click/iligjeakgjlifjecbioajbhmenjdadng
Pattern added in “Pro” mode : Enable - Check this box Init Wait (Sec) - 10 URL * - https://www.boat-ed.com/washington/course_content/course/10105002/* 1 xPath * = //*[@id=”timer_span_next”] Repeat 100 Repeat Interval 10
the idea here is each page has different timer but this way, it will keep trying every 10 seconds until ‘next’ button is available.
Roger Socks · 2018-06-27
This actually works! Although the syntax is very important.
Exact url: don’t type the 1 at the end of yours, and replace with your own state and course id, like so: https://www.boat-ed.com/northcarolina/course_content/course/10102802/*
xPath: //*[@id=’timer_span_next’]
Didn’t work initially until I noticed that you had used “ instead of ‘
weal · 2018-12-17
anyone figure out how to skip the hunter ed timers?