Reaching an internal wkhtmltopdf service through a commented-out SSRF form, upgrading the GET-only fetch to a POST with gopher://, and reading /flag.txt out of the rendered PDF
A one-bit Postgres oracle with stacked queries, an input lowercaser that silently folds payload literals, and a pg_read_file grant that pg_has_role denies
Slipping past a single non-recursive ../ strip with a nested ....// sequence to read a file outside the served directory
Writeup for Web 2 Doc 2 from Nullcon HackIM CTF 2026. A Web challenge involving WeasyPrint LFI via PDF attachments.
