Reaching an internal wkhtmltopdf service through a commented-out SSRF form, upgrading the GET-only fetch to a POST with gopher://, and reading /flag.txt out of the rendered PDF
Pointing a screenshot drone at its own admin session through an IPv6 loopback the blocklist missed, then using a URL fragment to scroll the flag into the viewport
Chaining a libinjection-evading second-order SQLi into a PostGIS BAG TEMPLATE gopher SSRF, rewriting Patroni config in unauthenticated etcd to get archive_command RCE
Writeup for Invoice Generator from LA CTF 2026. A Web challenge involving PDF generation and SSRF via XSS.
Writeup for Meowy from Nullcon HackIM CTF 2026. A Web challenge involving Flask session forgery, SSRF, and Werkzeug PIN RCE.
