Blacklist-Bypass

A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint.