Firewall

uoftctf2026

Task: Web server behind an eBPF/TC firewall that blocks packets containing "flag" or "%" with per-packet stateless inspection. Solution: Bypassed the ingress filter by splitting "flag" across two TCP segments using TCP_NODELAY, and bypassed the egress filter by requesting the file in 3-byte HTTP Range chunks (smaller than the 4-byte blocked pattern).