// the take
A self-contained CTF web challenge built around a real bug in automated screenshot services (the classic 'bot visits your URL and takes a screenshot' SSRF/XSS pattern). It's for people studying or running web security CTFs, not for production use — think of it as a packaged lesson rather than a tool.
- Docker-compose setup mirrors a realistic target: a Flask app, a separate headless-Chrome service, and an admin bot that visits user-submitted URLs — the actual attack surface instead of a toy example
- Ships both the challenge and the solution (on a separate `solution` branch) plus a video writeup, so you can verify your exploit against the author's intended path
- Based on a bug LiveOverflow found in the wild, so solving it teaches something transferable rather than an artificial puzzle
- Dead since 2021 — Dockerfiles pin old base images and Python/Chrome versions with since-patched CVEs, so spinning it up today means running intentionally vulnerable *and* unpatched infrastructure
- It's a single fixed challenge, not a framework: there's no way to regenerate variants or reuse the harness for a different bug class
- No tests, no CI, and a `sqlite.db` committed straight into the repo — fine for a one-off CTF box, but don't take any part of this as a reference for how to structure a real app
- The admin bot holds the flag directly, so this is only safe to run in an isolated/sandboxed environment, never exposed on an open network
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →