THM: Hollow Shell

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

August 12, 2026 · 5 min