LinkPeek is a URL preview service. It'll fetch any URL you give it — including internal ones. Find the hidden endpoint that was never meant to be public.
Use the URL preview feature to make the server request an internal endpoint and retrieve the flag.