$ cat writeup.md…
$ cat writeup.md…
bug-makers
Task: Express.js app with SVG avatar upload parsed by XML parser with entity resolution enabled. Solution: XXE injection in SVG file to read /flag.txt via file:// protocol SYSTEM entity.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar