Python

A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal.

A commit-reveal rock-paper-scissors whose non-binding sha256(r1 + message + r2) commitment lets you open one hash to any winning move and sweep all 100 rounds.

A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag.

Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost.

Reversing a 250-state control-flow-flattened automaton whose success check requires visiting every state — i.e. finding a Hamiltonian path through the transition graph.

A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.