Secure_sign_on

Last month, we hacked the authentication logic of the evil “Pustekuchen Corp.”. They have just updated their social media platform and have rewritten everything in safe rust. Also, there is this fancy super secure single sign-on solution and every employee account is migrating to it.

We already tried to phish some employers yesterday. Good news: Everyone clicked on headlines containing “Cat videos” - but they just entered garbage into our password forms as a distraction! Grrrr.

Now, you need to help us. We identified one individual who clicked on our cat videos, and now you need to hack her.

Someone we only know as “christine-catlover[at]pustekuchen.platypwnies.de”. Apparently, she is not registered on their social media platform, but she was the first one who clicked on our cat videos. Rumours have it that she is head of security at “Pustekuchen Corp.”. Hilarious…

Indeed, she bragged about building it via a telegram and told everyone that no one could ever steal the flag from her single sign-on account. Can it really be that there are no soundness holes in the new authentication logic? Well, let’s find out.

Note: this challenge takes some time to load, so please be patient (1-2 min).

CAT