Path-Traversal

Classic path traversal — the challenge name tells you exactly what to do.

Path traversal via /view?file=../flag.txt reads the server-side flag file.

An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie.

A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag.