Lfi

Classic path traversal — the challenge name tells you exactly what to do.

Path traversal via /view?file=../flag.txt reads the server-side flag file.

A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding.

SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app.

An MD5-only oracle over arbitrary paths is turned into a full file disclosure using the error-based PHP filter-chain oracle to leak /flag byte-by-byte.