Solution
Rot1
ffuf -w rot1-wl.txt -u 'http://challenge.nahamcon.com:30277/FUZZ/'
qbhf [Status: 403, Size: 153, Words: 3, Lines: 8, Duration: 306ms]rot2
ffuf -w wordlist_rot2.txt -u 'http://challenge.nahamcon.com:30277/qbhf/FUZZ'
oguucig [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 276ms]rot3
ffuf -w rot3_wordlist.txt -u 'http://challenge.nahamcon.com:30277/qbhf/oguucig/FUZZ'
wrnhq [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 283ms]rot4
ffuf -w rot4_wordlist.txt -u 'http://challenge.nahamcon.com:30277/qbhf/oguucig/wrnhq/FUZZ'
lewl [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 272ms]Finally for the flag
curl -iL 'http://challenge.nahamcon.com:30277/qbhf/oguucig/wrnhq/lewl'HTTP/1.1 301 Moved PermanentlyServer: nginx/1.26.3Date: Sat, 24 May 2025 13:25:08 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveLocation: /qbhf/oguucig/wrnhq/lewl/
HTTP/1.1 200 OKServer: nginx/1.26.3Date: Sat, 24 May 2025 13:25:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/8.2.28
flag{afd87cae63c08a57db7770b4e52081d3}