Pointing a screenshot drone at its own admin session through an IPv6 loopback the blocklist missed, then using a URL fragment to scroll the flag into the viewport
A ROP chain limited to three bytes per call, used to speak to a seccomped child process over its socketpair and hand it a negative vault index
Reading a bot username through a CSS :has() oracle that drives window.length across origins, under a CSP with no subresource holes and COOP disabled on plain http
