Super Secure Server — broncoctf2026

Description

I just finished developing my very first API to handle secure logins to my very own website! To keep things extra secure, I won't even tell you my username, so now there's really no way you can hack me!

A Flask login page (Server header Werkzeug/3.1.8 Python/3.14.6) where all authentication logic lives in client-side JavaScript. Two fatal flaws let us authenticate without knowing (or even needing) any credentials.

Analysis

GET / returns an HTML login form plus inline JavaScript that:

1. Fetches /api/config and stores data.username / data.password.
2. On submit, compares the typed username/password to the leaked values client-side (if (u === leakedUser && p === leakedPass)).
3. If they match, sends POST /login with JSON body { "authenticated": true } and follows data.redirect on success.

Inline JS excerpt:

fetch('/api/config').then(res=>res.json()).then(data=>{
  leakedUser = data.username;
  leakedPass = data.password;
  ...
  if (u === leakedUser && p === leakedPass) {
    fetch('/login', { method:'POST', headers:{'Content-Type':'application/json'},
      body: JSON.stringify({ authenticated: true }) })
    .then(res=>res.json()).then(data=>{ if(data.success) window.location.href = data.redirect; })
  }
});

Two flaws:

...