Web Application Security
A 'URL preview' feature fetches any URL you give it, from the server. Use it to reach an internal-only metadata service that is not exposed to you directly, and read the flag it returns.
loading simulator…
An XML import endpoint parses uploaded XML with external entities enabled. Define an external entity that reads a server file and have it reflected back to exfiltrate the flag.
loading simulator…