Athenactf

The challenge involved finding a source leak via express.static, bypassing authentication via the dbg. session prefix and exploiting path traversal in /export.