NOCT CTF 2026

Web exploitation challenges.

It fetches arbitrary URLs and returns their content, making it vulnerable to SSRF.

The home page exposed a CherryPic image-metadata feature: