$ ctf42

OnePass

Mobile weight 24.66 No technique tags yet.
Difficulty Not rated yet

Author: KyootyBella

Flag format: brunner{...}

Author: KyootyBella

Brunnerne A/S completed its single sign-on rollout in Q2, on time and within scope. One account, one button, every internal tool - including the board portal.

During rollout, a possible redirect validation issue was reported, but IT could not reproduce it and closed the finding as WONTFIX.

To help debug sign-in problems without borrowing anyone's phone, the office provides a support simulator: give it a OnePass authorization URL, and it opens the URL in the currently signed-in office session before reporting the redirect chain.

The current session belongs to Hanne Bak, Head Baker. She has board access, strong opinions about cake, and apparently a browser willing to follow whatever OnePass tells it to.

Writeups

Official

No official writeup linked.

Community

No community writeups yet. Solved it? Share how.

Log in to add a community writeup.