N0PS25: Writeup for Web/Plotwist
This writeup covers the solution to the “Plotwist” web challenge from N0PS CTF 2025, which involves bypassing NGINX access controls to reach a restricted API endpoint.
This writeup covers the solution to the “Plotwist” web challenge from N0PS CTF 2025, which involves bypassing NGINX access controls to reach a restricted API endpoint.
A Flask-based web application echoing user-provided data via a CSV export feature. Vulnerable to SSTI