A quick and dirty template for automating bankid session fixation outlined in https://mastersplinter.work/research/bankid/
This template needs to be adjusted to each target by:
- Adding url(s)
- Make the headless browser click & navigate to the correct place
- Reading the JS response and extract the
autostarttoken(or extract it from the DOM)
Use ngrok & run it locally. Make sure your phone is not on the same network as the laptop starting the session.