← Getting my school grades before release

December 4, 2024: I discovered how to access my school grades before my school officially released them.

Everyone knows the Inspect Element feature on browsers and how it lets you modify elements on a webpage. But one of the most important features is the Network tab, which lets you see what the browser is requesting and what the server is sending back.

I used the Network tab to see how the website worked, and I found some interesting things:

1. The browser asks the server which grades and periods should be displayed.
2. The server responds with the "active" (active just means they want you to see it [Image 1]) grades and periods.
3. The browser asks the server for the period averages in a separate request.
4. The server responds with whatever grades the browser requests.
5. The browser organizes and displays the data.

It turns out that a file named NOTAS_SeriePeriodoAtivo.asp tells the browser which periods and grades it should hide, even if the server already sent that data.

Using Firefox's Network Override option, I can modify the response and make the website display the hidden data directly in the official interface. With that, I could see my grades before the official release.

After two days, I sent an email to my school explaining how that happened. At first, they didn't seem concerned, since I was only accessing data that I would have been able to see a little later anyway.

In May 2025, I discovered that removing a parameter from the same request (NOTAS_SeriePeriodoAtivo.asp) allowed it to return individual grades. Our teachers always said they made changes to our grades and that we wouldn't be able to see those changes. But in the NOTAS_SeriePeriodoAtivo.asp request, I saw that the request body had three parameters specifying "cdStatus" [Image 2]

After some testing, I found out that cdStatus defines which type of grade the server should send. With the original three parameters, the server only responds with final grades from each period.

Then I removed all the cdStatus parameters, and I actually got the exam and individual grades the teachers talked about. I wrote everything down so I could compare exam grades to what we were given on paper (they matched exactly).

Thank you for your time!