4 min read
GPN CTF 2026 — Secure Secretpickle Writeup
Pickle RCE is sandboxed and the client HTML is sanitized, so the flag comes from the admin bot instead: it visits any URL you hand it, including file:///flag.txt, and returns the screenshot.
#CTF#Cybersecurity#Web