Challenge

A service at /api?url= that validates the target is not an internal address, then makes the request. The flag lives on an internal service the fetcher can reach.

Approach

The check and the fetch are two separate DNS lookups, which is a TOCTOU gap. If the name resolves to a public address when validated and to 127.0.0.1 when fetched, the guard passes and the request still lands on localhost.

rbndr makes this easy. It serves a host that flips between two encoded IPs on a one second TTL. The subdomain packs both addresses in hex, and 7f000001 is 127.0.0.1.

Solution

http://localhost:1337/api?url=http://03af7344.7f000001.rbndr.us:5001/

It worked locally right away. On remote it took about thirty minutes of retries for the rebind to land on the right side of the race. Just some infra weirdness, pretty simple challenge overall.

Flag

K17{DNS___more_l1ke_d0main_name_shuffl3}