Information-Disclosure

A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding.

A static HTML page stuffed with a movie transcript hides the flag in a paragraph marked hidden=“true” — invisible in the browser but right there in the page source.