7 min read
Codegate 2026 — ERP_system Writeup
A PHP stream filter that hashes whatever it reads turns into an oracle: chain an SSRF in hash.php through a public redirector to a localhost-only secret reader, then recover the flag one byte at a time from a 500-vs-200 side channel.
#CTF#Cybersecurity#Web