Iot

A SQLi login leaked the vending machine config, which spoke MQTT over WebSockets. Flipping the right switch topic vended the item. First blood.