DEAD VAULT — Zer0d4yh31st CTF
A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint.
Web
Web exploitation challenges from Zer0d4yh31st CTF.
No writeups match your filter.
La Casa de Papel (Secure Comms) — Zer0d4yh31st CTF
A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.