https://th3b0ywh0l1v3d.github.io/tags/blacklist-bypass/ Recent content in Blacklist-Bypass on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/dead-vault/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/dead-vault/ A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint.