Brute-Force

Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain.

A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table.