This challenge required decoding a WAV file containing DTMF tones, translating them into a T9 keyboard input, and uncovering a URL leading to the final flag.
Hacking a note-taking app from BITSCTF 2025. The exploit leverages a UTF-8 to ASCII conversion issue to inject XSS that remains unnoticed by DOMPurify and uses angular.js from Cloudflare CDN to bypass CSP restrictions.