webhard

RelayDesk

codegate2026

Task: Go-based support ticket system with custom URL parser and admin bot. Solution: URL parsing confusion using IPv6 + fullwidth dots to bypass validation, then leak flag via 4-char fragment oracle.

$ ls tags/ techniques/
playwrightgoadmin_botpostmessageurl_parsingipv6multi_serviceticket_system
url_parsing_confusionipv6_mapped_addressfullwidth_character_bypasspostmessage_exploitationoracle_based_leakfragment_matching_oracle
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]