A robots.txt tip-off, a one-quote login bypass, and a newline in a ping box open the door; a leaked bcrypt hash and a sudo-able find close out the promotion.

A SQLi login bypass and a Node preview route that require()s uploads into RCE, then loot on disk and a leaky APK carry the foothold clean through a pivot to Domain Admin.

A hidden portal, a newline that smuggles commands past the filter, and a KeePass vault guarding root.

A friendly starter: a file:// wrapper leaks the creds and a UNION injection grabs the flag.