[h1-2006 CTF] Payments for May have been processed!

How it was found

Hi :)

First off thanks for a great CTF! It had its ups and downs (mainly due to my mistakes) but here is the final flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$

My write up can be found at https://devcraft.io/bountypay-h1-2006-ctf.html (unpublished) detailing the process, tools, and mistakes I made along the way.

Cheers, Will

Impact

• Password disclosure and multiple 2FA bypasses allowing an attacker to process payments