I was expecting this to be more nooby based on the title. But instead they built an exploit that bypassed multiple input validation stages with clever hacks. Even going as far as to setup sub-domains to resemble the base domain. I'd not have expected this to work and found it neat in itself. But I guess seeing how complex domains are to parse with regex makes it easy to miss things (or maybe it was just something like a: '... in variable' check, idk.)

Author knows their stuff. I admire how much dedication that kind of craft takes. Spending so much time to get further along. Would make for an interesting career.