Really enjoyed this challenge. The biggest challenge was to bypass the ‘blind’ exfiltration and length restriction. Found a nice way to do both with one method. If you’ve already solved it, I’ll happily disclose my method. If not, think about other ways to send/receive data in a HTTP request/response