The notebook
RsaCtfTool: https://github.com/Ganapati/RsaCtfTool
. transforms to _ in php, can bypass preg_match("/_| /i", $var).
dnsrecon can be used to find flag hidden in DNS records.
webshell: "$_=" + make_letters("echoFlag") + ";$_();" where echoFlag is the function to execute in server.