An off-by-one that lands the frame CRC byte on a capacity field, stretching the dump command until it spills the canary and a PIE pointer
A textbook printf(buf) with eight tries, leaking PIE and libc off the stack then overwriting printf@got with system in a single format call
Reaching an internal wkhtmltopdf service through a commented-out SSRF form, upgrading the GET-only fetch to a POST with gopher://, and reading /flag.txt out of the rendered PDF
