DOJO CHALLENGE #8 Winners!

This write-up documents a Dojo CTF challenge where the author bypasses multiple URL-based security checks in a Deno application to perform an SSRF-like retrieval of a /secret endpoint. By exploiting inconsistencies between the Deno URL object's parsed pathname and the raw request string—using the host value '0', URL-encoded traversal (%2e%2e) and non-standard separators—the author obtains the secret flag and explains the step-by-step technique.