2021 CONTRACT → penetration-tester2021 KONTRAKT → penetration-tester
Penetration Tester, Independent
A university security project found full account takeover in a widely used Danish payroll app. We disclosed it, and the company hired us to keep looking.
Fifty students, 28 groups, 21 apps — and nine of them turned out to have critical vulnerabilities. My group drew a widely used Danish payroll app: payslips, CPR numbers, bank details, hours worked. We decompiled it, ran it through a static analyzer, and put a man-in-the-middle proxy between the app and its backend.
The flaw was in the authentication flow. The endpoint that reset a user’s PIN required no authentication at all, handed back the identifier used for HTTP Basic auth, and set a temporary PIN that the app had hardcoded as a constant — the same four digits for every user in the system. The SMS confirmation code that was supposed to gate all of this could simply be skipped. We reported it, the company met with us, and then paid us to come back and look for more.
a.Full account takeover — an unauthenticated PIN-reset endpoint returned the credential ID and set a temporary PIN that was hardcoded in the app and identical for every user. A 6-character login ID was all it took to read or alter anyone's payslips, CPR number and bank details.
b.The whole user base was in range — roughly 1.9 million possible IDs, an open endpoint that told you which ones existed, and no rate limiting. Brute forcing the full range was entirely realistic.
c.Disclosure, then a contract — reported to the company, walked them through it, and got hired on a consulting contract to do further penetration testing. Covered by Aarhus University, Ritzau and Computerworld in 2021.
d.Lessons that stuck — the experience still shapes how I review authentication and integrations as an architect.
PROJECTS — DEPLOYED DURING THIS EVENTPROJEKTER — DEPLOYET UNDER DENNE EVENT1 DEPLOYMENTS
P1
Payroll app security assessmentMSc Network Security project at Aarhus University, with Anders Lindskov Kloborg: software, authentication, network and privacy analysis of a Xamarin payroll app. Decompiled the assemblies, ran static analysis, and intercepted traffic with a man-in-the-middle proxy — which is how the authentication flaw surfaced. Disclosed responsibly and since patched.